| @@ -414,8 +414,12 @@ | ||
| 414 | 414 | wp_send_json_error(); |
| 415 | 415 | } |
| 416 | 416 | $course_id = (int) tutor_utils()->avalue_dot('tutor_topic_course_ID', $_POST); |
| 417 | 417 | $next_topic_order_id = tutor_utils()->get_next_topic_order_id($course_id); |
| 418 | + | |
| 419 | + if(!tutils()->can_user_manage('course', $course_id)) { | |
| 420 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 421 | + } | |
| 418 | 422 | |
| 419 | 423 | $topic_title = sanitize_text_field( $_POST['topic_title'] ); |
| 420 | 424 | $topic_summery = wp_kses_post( $_POST['topic_summery'] ); |
| 421 | 425 | |
| @@ -444,8 +448,12 @@ | ||
| 444 | 448 | $topic_id = (int) sanitize_text_field($_POST['topic_id']); |
| 445 | 449 | $topic_title = sanitize_text_field($_POST['topic_title']); |
| 446 | 450 | $topic_summery = wp_kses_post($_POST['topic_summery']); |
| 447 | 451 | |
| 452 | + if(!tutils()->can_user_manage('topic', $topic_id)) { | |
| 453 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 454 | + } | |
| 455 | + | |
| 448 | 456 | $topic_attr = array( |
| 449 | 457 | 'ID' => $topic_id, |
| 450 | 458 | 'post_title' => $topic_title, |
| 451 | 459 | 'post_content' => $topic_summery, |
| @@ -643,13 +651,15 @@ | ||
| 643 | 651 | |
| 644 | 652 | $course_id = (int) sanitize_text_field($_POST['course_id']); |
| 645 | 653 | $search_terms = sanitize_text_field(tutor_utils()->avalue_dot('search_terms', $_POST)); |
| 646 | 654 | |
| 655 | + if(!tutils()->can_user_manage('course', $course_id)) { | |
| 656 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 657 | + } | |
| 658 | + | |
| 647 | 659 | $saved_instructors = tutor_utils()->get_instructors_by_course($course_id); |
| 648 | - | |
| 649 | 660 | $instructors = array(); |
| 650 | 661 | |
| 651 | - | |
| 652 | 662 | $not_in_sql = apply_filters('tutor_instructor_query_when_exists', " AND ID <1 "); |
| 653 | 663 | |
| 654 | 664 | if ($saved_instructors){ |
| 655 | 665 | $saved_instructors_ids = wp_list_pluck($saved_instructors, 'ID'); |
| @@ -689,8 +699,12 @@ | ||
| 689 | 699 | |
| 690 | 700 | public function tutor_add_instructors_to_course(){ |
| 691 | 701 | $course_id = (int) sanitize_text_field($_POST['course_id']); |
| 692 | 702 | $instructor_ids = tutor_utils()->avalue_dot('tutor_instructor_ids', $_POST); |
| 703 | + | |
| 704 | + if(!tutils()->can_user_manage('course', $course_id)) { | |
| 705 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 706 | + } | |
| 693 | 707 | |
| 694 | 708 | if (is_array($instructor_ids) && count($instructor_ids)){ |
| 695 | 709 | foreach ($instructor_ids as $instructor_id){ |
| 696 | 710 | add_user_meta($instructor_id, '_tutor_instructor_course_id', $course_id); |
| @@ -721,8 +735,12 @@ | ||
| 721 | 735 | |
| 722 | 736 | $instructor_id = (int) sanitize_text_field($_POST['instructor_id']); |
| 723 | 737 | $course_id = (int) sanitize_text_field($_POST['course_id']); |
| 724 | 738 | |
| 739 | + if(!tutils()->can_user_manage('course', $course_id)) { | |
| 740 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 741 | + } | |
| 742 | + | |
| 725 | 743 | $wpdb->delete($wpdb->usermeta, array('user_id' => $instructor_id, 'meta_key' => '_tutor_instructor_course_id', 'meta_value' => $course_id) ); |
| 726 | 744 | wp_send_json_success(); |
| 727 | 745 | } |
| 728 | 746 | |
| @@ -727,8 +745,13 @@ | ||
| 727 | 745 | } |
| 728 | 746 | |
| 729 | 747 | public function tutor_delete_dashboard_course(){ |
| 730 | 748 | $course_id = intval(sanitize_text_field($_POST['course_id'])); |
| 749 | + | |
| 750 | + if(!tutils()->can_user_manage('course', $course_id)) { | |
| 751 | + wp_send_json_error( array('message'=>__('Access Denied', 'tutor')) ); | |
| 752 | + } | |
| 753 | + | |
| 731 | 754 | wp_trash_post($course_id); |
| 732 | 755 | wp_send_json_success(['element'=>'course']); |
| 733 | 756 | } |
| 734 | 757 | |
