Merge branch 'card-64065' into latest

WPDevelopers · Jul 7, 2024 · 2a6e3ad · 2a6e3ad
2 parents 5d91af8 + 5a6e7ad
commit 2a6e3ad
Show file tree

Hide file tree

Showing 4 changed files with 2,403 additions and 8 deletions.
diff --git a/EmbedPress/Ends/Back/Handler.php b/EmbedPress/Ends/Back/Handler.php
@@ -56,6 +56,12 @@ public function __construct($pluginName, $pluginVersion)
 
     public function get_instagram_userdata_ajax()
     {
+
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'You do not have sufficient permissions to access this functionality.'));
+            return;
+        }
+
         if (isset($_POST['_nonce']) && wp_verify_nonce($_POST['_nonce'], 'embedpress_elements_action')) {
             if (isset($_POST['access_token'])) {
                 $access_token = sanitize_text_field($_POST['access_token']);
@@ -100,6 +106,11 @@ public function get_instagram_userdata_ajax()
 
     public function sync_instagram_data_ajax()
     {
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'You do not have sufficient permissions to access this functionality.'));
+            return;
+        }
+
         if (isset($_POST['_nonce']) && wp_verify_nonce($_POST['_nonce'], 'embedpress_elements_action')) {
             if (isset($_POST['access_token'])) {
 
@@ -904,6 +915,11 @@ public function getUrlSchemes()
 
     public function delete_instagram_account()
     {
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'You do not have sufficient permissions to access this functionality.'));
+            return;
+        }
+
         if (isset($_POST['_nonce']) && wp_verify_nonce($_POST['_nonce'], 'embedpress_elements_action')) {
             $user_id = isset($_POST['user_id']) ? $_POST['user_id'] : '';
             $account_type = isset($_POST['account_type']) ? $_POST['account_type'] : '';

diff --git a/EmbedPress/Ends/Back/Settings/EmbedpressSettings.php b/EmbedPress/Ends/Back/Settings/EmbedpressSettings.php
@@ -110,6 +110,12 @@ function embedpress_maybe_redirect_to_settings() {
 
 	}
 	public function update_elements_list() {
+
+		if (!current_user_can('manage_options')) {
+			wp_send_json_error(array('message' => 'You do not have sufficient permissions to access this functionality.'));
+			return;
+		}
+
 		if ( !empty($_POST['_wpnonce'] && wp_verify_nonce( $_POST['_wpnonce'], 'embedpress_elements_action')) ) {
 			$option = EMBEDPRESS_PLG_NAME.":elements";
 			$elements = (array) get_option( $option, []);