| @@ -1420,8 +1420,12 @@ | ||
| 1420 | 1420 | */ |
| 1421 | 1421 | public function getQueryData() { |
| 1422 | 1422 | check_ajax_referer( Visualizer_Plugin::ACTION_FETCH_DB_DATA . Visualizer_Plugin::VERSION, 'security' ); |
| 1423 | 1423 | |
| 1424 | + if ( ! current_user_can( 'edit_posts' ) ) { | |
| 1425 | + wp_send_json_error( array( 'msg' => __( 'Action not allowed for this user.', 'visualizer' ) ) ); | |
| 1426 | + } | |
| 1427 | + | |
| 1424 | 1428 | $params = wp_parse_args( $_POST['params'] ); |
| 1425 | 1429 | $chart_id = filter_var( $params['chart_id'], FILTER_VALIDATE_INT ); |
| 1426 | 1430 | |
| 1427 | 1431 | $source = new Visualizer_Source_Query( stripslashes( $params['query'] ), $chart_id, $params ); |
| @@ -1586,8 +1590,12 @@ | ||
| 1586 | 1590 | // Save the image in the uploads directory. |
| 1587 | 1591 | require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 1588 | 1592 | \WP_Filesystem(); |
| 1589 | 1593 | global $wp_filesystem; |
| 1594 | + if ( ! is_a( $wp_filesystem, 'WP_Filesystem_Base' ) ) { | |
| 1595 | + $creds = request_filesystem_credentials( site_url() ); | |
| 1596 | + wp_filesystem( $creds ); | |
| 1597 | + } | |
| 1590 | 1598 | $upload_file = $wp_filesystem->put_contents( $upload_path . $hashed_filename, $decoded ); |
| 1591 | 1599 | |
| 1592 | 1600 | // Insert new chart image. |
| 1593 | 1601 | $attachment = array( |
