| @@ -364,8 +364,11 @@ | ||
| 364 | 364 | break; |
| 365 | 365 | |
| 366 | 366 | // ── Database query ──────────────────────────────────────────────── |
| 367 | 367 | case 'db_query': |
| 368 | + if ( ! current_user_can( 'manage_options' ) && ! is_super_admin() ) { | |
| 369 | + wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ), 403 ); | |
| 370 | + } | |
| 368 | 371 | if ( empty( $_POST['db_query'] ) ) { |
| 369 | 372 | wp_send_json_error( array( 'message' => __( 'No query provided.', 'visualizer' ) ) ); |
| 370 | 373 | } |
| 371 | 374 | $query = wp_unslash( $_POST['db_query'] ); |
