← All changes | classes/Visualizer/Module/Frontend.php +18 -7 4.0.3 → 4.0.5 View file →

		@@ -152,16 +152,27 @@
152	152	'enum' => array_merge( array( 'save', 'cancel' ), array_keys( $this->get_actions() ) ),
153	153	),
154	154	),
155	155	'permission_callback' => function ( WP_REST_Request $request ) {
156		- $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) );
157		- if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {
158		- // let save and cancel go without any check as past version of pro
159		- // did not send the X-WP-Nonce
160		- // we can change this at a later date.
161		- return true;
	156	+ $chart_id = absint( $request->get_param( 'chart' ) );
	157	+ if ( ! $chart_id ) {
	158	+ return false;
162	159	}
163		- return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id );
	160	+
	161	+ $chart = get_post( $chart_id );
	162	+ if ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type ) {
	163	+ return false;
	164	+ }
	165	+
	166	+ if ( in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {
	167	+ return current_user_can( 'edit_post', $chart_id );
	168	+ }
	169	+
	170	+ if ( 'publish' !== $chart->post_status ) {
	171	+ return current_user_can( 'edit_post', $chart_id );
	172	+ }
	173	+
	174	+ return apply_filters( 'visualizer_pro_show_chart', true, $chart_id );
164	175	},
165	176	'callback' => array( $this, 'perform_action' ),
166	177	)
167	178	);