Changeset 5627

Timestamp:

03/06/2015 04:16:31 PM (11 years ago)

Author:

johnjamesjacoby

Message:

Add capability checks to admin-area ajax methods. Props jdgrimes. (trunk)

Location:

trunk/src/includes/admin

Files:

• admin.php (modified) (2 diffs)
• converter.php (modified) (1 diff)

trunk/src/includes/admin/admin.php

@@ -704 +704 @@
         }
 
+        // Bail if user cannot moderate - only moderators can change hierarchy
+        if ( ! current_user_can( 'moderate' ) ) {
+            wp_die( '0' );
+        }
+
         // Check the ajax nonce
         check_ajax_referer( 'bbp_suggest_topic_nonce' );
@@ -732 +737 @@
         // Bail early if no request
         if ( empty( $_REQUEST['q'] ) ) {
+            wp_die( '0' );
+        }
+
+        // Bail if user cannot moderate - only moderators can change authorship
+        if ( ! current_user_can( 'moderate' ) ) {
             wp_die( '0' );
         }

trunk/src/includes/admin/converter.php

@@ -303 +303 @@
      */
     public function process_callback() {
+
+        // Bail if user cannot view import page
+        if ( ! current_user_can( 'bbp_tools_import_page' ) ) {
+            wp_die( '0' );
+        }
 
         // Verify intent