← All changes | src/class-permissions.php +8 -5 3.24.0 → 3.24.2 View file →

		@@ -49,8 +49,9 @@
49	49	* Returns whether the current user has the permission to access the
50	50	* specified Content Intelligence feature.
51	51	*
52	52	* @since 3.16.0
	53	+ * @since 3.24.2 Post-specific checks always require the `edit_post` capability.
53	54	*
54	55	* @param string $feature_name The feature's name.
55	56	* @param Parsely_Options_Content_Helper $pch_options The Content Intelligence options.
56	57	* @param int|false $post_id The post ID, if the check is for a specific post.
		@@ -60,8 +61,14 @@
60	61	string $feature_name,
61	62	$pch_options,
62	63	$post_id = false
63	64	): bool {
	65	+ // Post-specific checks always require edit access, whatever the filter
	66	+ // below returns.
	67	+ if ( (int) $post_id > 0 && ! current_user_can( 'edit_post', (int) $post_id ) ) {
	68	+ return false;
	69	+ }
	70	+
64	71	if ( isset( $pch_options[ $feature_name ] ) ) {
65	72	/**
66	73	* The feature's options.
67	74	*
		@@ -79,8 +86,9 @@
79	86	* Filters whether the current user can use the specified Content
80	87	* Intelligence feature.
81	88	*
82	89	* This filter can be used to override the default permissions check.
	90	+ * It cannot grant access to a post that the user cannot edit.
83	91	*
84	92	* @since 3.16.2
85	93	*
86	94	* @param ?bool $current_user_can_use_pch_feature Whether the current user can use the feature.
		@@ -138,13 +146,8 @@
138	146	// Check that at least one of the user's roles has access to the specific feature/post.
139	147	$allowed_roles = $feature_options['allowed_user_roles'];
140	148	if ( 0 === count( array_intersect( $user_roles, $allowed_roles ) ) ) {
141	149	return false;
142		- }
143		-
144		- // Check if the user can edit the post.
145		- if ( (int) $post_id > 0 ) {
146		- return current_user_can( 'edit_post', $post_id );
147	150	}
148	151
149	152	return true;
150	153	}