| @@ -99,9 +99,9 @@ | ||
| 99 | 99 | * |
| 100 | 100 | * @param int $chart_id Chart ID. |
| 101 | 101 | */ |
| 102 | 102 | private function _verify_chart_access( $chart_id ): void { |
| 103 | - if ( ! current_user_can( 'edit_post', $chart_id ) ) { | |
| 103 | + if ( ! self::can_edit_chart( $chart_id ) ) { | |
| 104 | 104 | wp_send_json_error( array( 'message' => __( 'Unauthorized.', 'visualizer' ) ), 403 ); |
| 105 | 105 | } |
| 106 | 106 | } |
| 107 | 107 | |
| @@ -368,9 +368,9 @@ | ||
| 368 | 368 | break; |
| 369 | 369 | |
| 370 | 370 | // ── Database query ──────────────────────────────────────────────── |
| 371 | 371 | case 'db_query': |
| 372 | - if ( ! current_user_can( 'manage_options' ) && ! is_super_admin() ) { | |
| 372 | + if ( ! current_user_can( 'manage_options' ) || ! is_super_admin() || ! Visualizer_Module::is_pro() ) { | |
| 373 | 373 | wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ), 403 ); |
| 374 | 374 | } |
| 375 | 375 | if ( empty( $_POST['db_query'] ) ) { |
| 376 | 376 | wp_send_json_error( array( 'message' => __( 'No query provided.', 'visualizer' ) ) ); |
| @@ -501,8 +501,12 @@ | ||
| 501 | 501 | $workflow_id = $response_body['data']['workflowId']; |
| 502 | 502 | } |
| 503 | 503 | } |
| 504 | 504 | |
| 505 | + if ( ! empty( $workflow_id ) ) { | |
| 506 | + set_transient( 'viz_ai_wf_' . $workflow_id, get_current_user_id(), 6 * HOUR_IN_SECONDS ); | |
| 507 | + } | |
| 508 | + | |
| 505 | 509 | wp_send_json_success( |
| 506 | 510 | array( |
| 507 | 511 | 'workflow_id' => $workflow_id, |
| 508 | 512 | ) |
| @@ -521,8 +525,12 @@ | ||
| 521 | 525 | |
| 522 | 526 | $workflow_id = isset( $_POST['workflow_id'] ) ? sanitize_text_field( wp_unslash( $_POST['workflow_id'] ) ) : ''; |
| 523 | 527 | if ( empty( $workflow_id ) ) { |
| 524 | 528 | wp_send_json_error( array( 'message' => __( 'Missing workflow ID.', 'visualizer' ) ) ); |
| 529 | + } | |
| 530 | + | |
| 531 | + if ( (int) get_transient( 'viz_ai_wf_' . $workflow_id ) !== get_current_user_id() ) { | |
| 532 | + wp_send_json_error( array( 'message' => __( 'Unauthorized.', 'visualizer' ) ), 403 ); | |
| 525 | 533 | } |
| 526 | 534 | |
| 527 | 535 | $agents_url = VISUALIZER_AGENTS_URL; |
| 528 | 536 | $workflow_slug = $this->_get_workflow_slug(); |
