WordPress.org
Get WordPress

Plugin Directory

Changeset 2996579


Ignore:
Timestamp:
11/15/2023 04:56:50 PM (2 years ago)
Author:
chrisakelley
Message:

Release 1.8.7.1

Location:
envira-gallery-lite
Files:
10 edited
1 copied

Legend:

Unmodified
Added
Removed

  • envira-gallery-lite/tags/1.8.7.1/envira-gallery-lite.php

    r2993297 r2996579  
    66 * Author:      Envira Gallery Team
    77 * Author URI:  http://enviragallery.com
    8  * Version:     1.8.7
     8 * Version:     1.8.7.1
    99 * Text Domain: envira-gallery-lite
    1010 *
    … …  
    5656     * @var string
    5757     */
    58     public $version = '1.8.7';
     58    public $version = '1.8.7.1';
    5959
    6060    /**

  • envira-gallery-lite/tags/1.8.7.1/includes/admin/ajax.php

    r2993297 r2996579  
    1919    // Run a security check first.
    2020    check_admin_referer( 'envira-gallery-change-type', 'nonce' );
     21
     22    if ( ! current_user_can( 'edit_posts' ) ) {
     23        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     24    }
    2125
    2226    // Prepare variables.
    … …  
    4145}
    4246
    43 add_action( 'wp_ajax_envira_gallery_change_preview', 'envira_gallery_ajax_change_preview' );
    44 /**
    45  * Returns the output for the Preview Metabox for the given Gallery Type.
     47add_action( 'wp_ajax_envira_gallery_set_user_setting', 'envira_gallery_ajax_set_user_setting' );
     48/**
     49 * Stores a user setting for the logged in WordPress User
    4650 *
    4751 * @since 1.5.0
    4852 */
    49 function envira_gallery_ajax_change_preview() {
    50 
    51     // Run a security check first.
    52     check_admin_referer( 'envira-gallery-change-preview', 'nonce' );
    53 
    54     // Prepare variables.
    55     $post_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    56     $type    = isset( $_POST['type'] ) ? sanitize_text_field( wp_unslash( $_POST['type'] ) ) : '';
    57 
    58     // Get the saved Gallery configuration.
    59     $data = Envira_Gallery_Lite::get_instance()->get_gallery( $post_id );
    60 
    61     // Iterate through the POSTed Gallery configuration (which comprises of index based fields),
    62     // overwriting the above with the supplied values.  This gives us the most up to date,
    63     // unsaved configuration.
    64     foreach ( wp_unslash( $_POST['data'] ) as $index => $field ) { // @codingStandardsIgnoreLine
    65 
    66         // Skip if this isnt' a configuration field.
    67         if ( strpos( $field['name'], '_envira_gallery[' ) === false ) {
    68             continue;
    69         }
    70 
    71         // Extract the key from the field name.
    72         preg_match_all( '/\[([^\]]*)\]/', $field['name'], $matches );
    73         if ( ! isset( $matches[1] ) || count( $matches[1] ) === 0 ) {
    74             continue;
    75         }
    76 
    77         // Add this field key/value pair to the configuration.
    78         $data['config'][ $matches[1][0] ] = $field['value'];
    79 
    80     }
    81 
    82     // Retrieve the preview for the type selected, using the now up-to-date gallery configuration.
    83     ob_start();
    84     do_action( 'envira_gallery_preview_' . $type, $data );
    85     $html = ob_get_clean();
    86 
    87     // Send back the response.
    88     echo wp_json_encode( $html );
    89     die;
    90 }
    91 
    92 add_action( 'wp_ajax_envira_gallery_set_user_setting', 'envira_gallery_ajax_set_user_setting' );
    93 /**
    94  * Stores a user setting for the logged in WordPress User
    95  *
    96  * @since 1.5.0
    97  */
    9853function envira_gallery_ajax_set_user_setting() {
    9954
    10055    // Run a security check first.
    10156    check_admin_referer( 'envira-gallery-set-user-setting', 'nonce' );
     57
     58    if ( ! current_user_can( 'edit_posts' ) ) {
     59        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     60    }
    10261
    10362    // Prepare variables.
    … …  
    12382    // Run a security check first.
    12483    check_admin_referer( 'envira-gallery-load-image', 'nonce' );
     84
     85    if ( ! current_user_can( 'edit_posts' ) ) {
     86        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     87    }
    12588
    12689    // Prepare variables.
    … …  
    188151    check_admin_referer( 'envira-gallery-insert-images', 'nonce' );
    189152
     153    if ( ! current_user_can( 'edit_posts' ) ) {
     154        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     155    }
     156
    190157    // Prepare variables.
    191158    $images = [];
    … …  
    268235    // Run a security check first.
    269236    check_admin_referer( 'envira-gallery-sort', 'nonce' );
     237
     238    if ( ! current_user_can( 'edit_posts' ) ) {
     239        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     240    }
    270241
    271242    // Prepare variables.
    … …  
    305276    // Run a security check first.
    306277    check_admin_referer( 'envira-gallery-remove-image', 'nonce' );
     278
     279    if ( ! current_user_can( 'edit_posts' ) ) {
     280        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     281    }
    307282
    308283    // Prepare variables.
    … …  
    351326    check_admin_referer( 'envira-gallery-remove-image', 'nonce' );
    352327
     328    if ( ! current_user_can( 'edit_posts' ) ) {
     329        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     330    }
     331
     332
    353333    // Prepare variables.
    354334    $post_id      = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    401381    // Run a security check first.
    402382    check_ajax_referer( 'envira-gallery-save-meta', 'nonce' );
     383
     384    if ( ! current_user_can( 'edit_posts' ) ) {
     385        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     386    }
    403387
    404388    // Prepare variables.
    … …  
    486470    check_admin_referer( 'envira-gallery-save-meta', 'nonce' );
    487471
     472    if ( ! current_user_can( 'edit_posts' ) ) {
     473        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     474    }
     475
    488476    // Prepare variables.
    489477    $post_id   = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    562550    check_admin_referer( 'envira-gallery-refresh', 'nonce' );
    563551
     552    if ( ! current_user_can( 'edit_posts' ) ) {
     553        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     554    }
     555
    564556    // Prepare variables.
    565557    $post_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    585577
    586578add_action( 'wp_ajax_envira_gallery_load_gallery_data', 'envira_gallery_ajax_load_gallery_data' );
     579
    587580/**
    588581 * Retrieves and return gallery data for the specified ID.
    … …  
    591584 */
    592585function envira_gallery_ajax_load_gallery_data() {
     586
     587    if ( ! current_user_can( 'edit_posts' ) ) {
     588        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     589    }
    593590
    594591    // Prepare variables and grab the gallery data.
    … …  
    611608    // Run a security check first.
    612609    check_admin_referer( 'envira-gallery-install', 'nonce' );
     610
     611    if ( ! current_user_can( 'install_plugins' ) ) {
     612        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'envira-gallery-lite' ) ] );
     613    }
    613614
    614615    // Install the addon.
    … …  
    672673    check_admin_referer( 'envira-gallery-activate', 'nonce' );
    673674
     675    if ( ! current_user_can( 'activate_plugins' ) ) {
     676        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to activate plugins.', 'envira-gallery-lite' ) ] );
     677    }
     678
    674679    // Activate the addon.
    675680    if ( isset( $_POST['plugin'] ) ) {
    … …  
    696701    // Run a security check first.
    697702    check_admin_referer( 'envira-gallery-deactivate', 'nonce' );
     703
     704    if ( ! current_user_can( 'activate_plugins' ) ) {
     705        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'envira-gallery-lite' ) ] );
     706    }
    698707
    699708    // Deactivate the addon.
    … …  
    780789    check_admin_referer( 'envira-gallery-dismiss-notice', 'nonce' );
    781790
     791    if ( ! current_user_can( 'edit_dashboard' ) ) {
     792        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to dismiss notices.', 'envira-gallery-lite' ) ] );
     793    }
     794
    782795    // Deactivate the notice.
    783796    if ( isset( $_POST['notice'] ) ) {
    … …  
    807820    // Run a security check first.
    808821    check_admin_referer( 'envira-gallery-dismiss-topbar', 'nonce' );
     822
     823    if ( ! current_user_can( 'edit_dashboard' ) ) {
     824        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to dismiss notices.', 'envira-gallery-lite' ) ] );
     825    }
     826
    809827    update_option( 'envira_pro_upgrade_header_dismissed', true );
    810828
    … …  
    823841    // Check nonce.
    824842    check_ajax_referer( 'envira-gallery-save-meta', 'nonce' );
     843
     844    if ( ! current_user_can( 'edit_posts' ) ) {
     845        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     846    }
     847
    825848
    826849    // Get required inputs.
    … …  
    847870    // Check nonce.
    848871    check_admin_referer( 'envira-gallery-editor-get-galleries', 'nonce' );
     872
     873    if ( ! current_user_can( 'edit_posts' ) ) {
     874        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     875    }
     876
    849877
    850878    // Get POSTed fields.
    … …  
    945973    check_admin_referer( 'envira-gallery-move-media', 'nonce' );
    946974
     975    if ( ! current_user_can( 'edit_posts' ) ) {
     976        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to move media.', 'envira-gallery-lite' ) ] );
     977    }
     978
    947979    // Get POSTed fields.
    948980    $from_gallery_id = isset( $_POST['from_gallery_id'] ) ? absint( $_POST['from_gallery_id'] ) : null;
    … …  
    9991031    check_admin_referer( 'envira-gallery-activate-partner', 'nonce' );
    10001032
     1033    if ( ! current_user_can( 'activate_plugins' ) ) {
     1034        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to activate plugins.', 'envira-gallery-lite' ) ] );
     1035    }
     1036
    10011037    // Activate the addon.
    10021038    if ( isset( $_POST['basename'] ) ) {
    1003         $activate = activate_plugin( wp_unslash( $_POST['basename'] ) );  // @codingStandardsIgnoreLine
     1039        $activate = activate_plugin( sanitize_text_field( wp_unslash( $_POST['basename'] ) ) );
    10041040
    10051041        if ( is_wp_error( $activate ) ) {
    … …  
    10261062    check_admin_referer( 'envira-gallery-deactivate-partner', 'nonce' );
    10271063
     1064    if ( ! current_user_can( 'activate_plugins' ) ) {
     1065        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'envira-gallery-lite' ) ] );
     1066    }
     1067
    10281068    // Deactivate the addon.
    10291069    if ( isset( $_POST['basename'] ) ) {
    … …  
    10461086
    10471087    check_admin_referer( 'envira-gallery-install-partner', 'nonce' );
     1088
     1089    if ( ! current_user_can( 'install_plugins' ) ) {
     1090        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'envira-gallery-lite' ) ] );
     1091    }
     1092
    10481093    // Install the addon.
    10491094    if ( isset( $_POST['download_url'] ) ) {
    … …  
    10551100        set_current_screen();
    10561101
    1057         // Prepare variables.
    10581102        $method = '';
    1059         $url    = add_query_arg(
    1060             [
    1061                 'page' => 'pdfemb_list_options',
    1062             ],
    1063             admin_url( 'options-general.php' )
    1064         );
    1065         $url    = esc_url( $url );
     1103        $url    = esc_url( admin_url( 'edit.php?post_type=envira&page=envira-gallery-lite-about-us' ) );
    10661104
    10671105        // Start output bufferring to catch the filesystem form if credentials are needed.
    … …  
    11841222    // Start output bufferring to catch the filesystem form if credentials are needed.
    11851223    ob_start();
     1224
     1225    $method = '';
     1226    $url    = esc_url( admin_url( 'edit.php?post_type=envira&page=envira-gallery-lite-about-us' ) );
     1227
    11861228    $creds = request_filesystem_credentials( $url, $method, false, false, null );
    11871229    if ( false === $creds ) {

  • envira-gallery-lite/tags/1.8.7.1/includes/admin/common.php

    r2993297 r2996579  
    135135     */
    136136    public function add_upgrade_menu_item() {
     137
    137138        global $submenu;
    138139
    … …  
    144145            esc_url( $this->get_upgrade_link( 'http://enviragallery.com/lite/', 'adminsidebar', 'unlockprosidebar' ) )
    145146        );
     147
     148        if ( ! current_user_can( 'manage_options' ) ) {
     149            return;
     150        }
    146151
    147152        $upgrade_link_position = key(

  • envira-gallery-lite/tags/1.8.7.1/includes/admin/metaboxes.php

    r2993297 r2996579  
    551551            ]
    552552        );
    553     }
    554 
    555     /**
    556      * Callback for displaying the Preview metabox.
    557      *
    558      * @since 1.5.0
    559      *
    560      * @param object $post The current post object.
    561      */
    562     public function meta_box_preview_callback( $post ) {
    563 
    564         // Get the gallery data.
    565         $data = get_post_meta( $post->ID, '_eg_gallery_data', true );
    566 
    567         // Output the display based on the type of slider being created.
    568         echo '<div id="envira-gallery-preview-main" class="envira-clear">';
    569 
    570         $this->preview_display( $this->get_config( 'type', $this->get_config_default( 'type' ) ), $data );
    571 
    572         echo '</div>
    573               <div class="spinner"></div>';
    574553    }
    575554

  • envira-gallery-lite/tags/1.8.7.1/readme.txt

    r2993297 r2996579  
    55Tested up to: 6.4.1
    66Requires PHP: 5.6
    7 Stable tag: 1.8.7
     7Stable tag: 1.8.7.1
    88License: GNU General Public License v2.0 or later
    99
    … …  
    210210== Changelog ==
    211211
     2121.8.7.1
     213
     214* Fixed: Notices for non-admin users in admin.
     215* Fixed: Capability checks for ajax calls
     216
    2122171.8.7
    213218

  • envira-gallery-lite/trunk/envira-gallery-lite.php

    r2993297 r2996579  
    66 * Author:      Envira Gallery Team
    77 * Author URI:  http://enviragallery.com
    8  * Version:     1.8.7
     8 * Version:     1.8.7.1
    99 * Text Domain: envira-gallery-lite
    1010 *
    … …  
    5656     * @var string
    5757     */
    58     public $version = '1.8.7';
     58    public $version = '1.8.7.1';
    5959
    6060    /**

  • envira-gallery-lite/trunk/includes/admin/ajax.php

    r2993297 r2996579  
    1919    // Run a security check first.
    2020    check_admin_referer( 'envira-gallery-change-type', 'nonce' );
     21
     22    if ( ! current_user_can( 'edit_posts' ) ) {
     23        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     24    }
    2125
    2226    // Prepare variables.
    … …  
    4145}
    4246
    43 add_action( 'wp_ajax_envira_gallery_change_preview', 'envira_gallery_ajax_change_preview' );
    44 /**
    45  * Returns the output for the Preview Metabox for the given Gallery Type.
     47add_action( 'wp_ajax_envira_gallery_set_user_setting', 'envira_gallery_ajax_set_user_setting' );
     48/**
     49 * Stores a user setting for the logged in WordPress User
    4650 *
    4751 * @since 1.5.0
    4852 */
    49 function envira_gallery_ajax_change_preview() {
    50 
    51     // Run a security check first.
    52     check_admin_referer( 'envira-gallery-change-preview', 'nonce' );
    53 
    54     // Prepare variables.
    55     $post_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    56     $type    = isset( $_POST['type'] ) ? sanitize_text_field( wp_unslash( $_POST['type'] ) ) : '';
    57 
    58     // Get the saved Gallery configuration.
    59     $data = Envira_Gallery_Lite::get_instance()->get_gallery( $post_id );
    60 
    61     // Iterate through the POSTed Gallery configuration (which comprises of index based fields),
    62     // overwriting the above with the supplied values.  This gives us the most up to date,
    63     // unsaved configuration.
    64     foreach ( wp_unslash( $_POST['data'] ) as $index => $field ) { // @codingStandardsIgnoreLine
    65 
    66         // Skip if this isnt' a configuration field.
    67         if ( strpos( $field['name'], '_envira_gallery[' ) === false ) {
    68             continue;
    69         }
    70 
    71         // Extract the key from the field name.
    72         preg_match_all( '/\[([^\]]*)\]/', $field['name'], $matches );
    73         if ( ! isset( $matches[1] ) || count( $matches[1] ) === 0 ) {
    74             continue;
    75         }
    76 
    77         // Add this field key/value pair to the configuration.
    78         $data['config'][ $matches[1][0] ] = $field['value'];
    79 
    80     }
    81 
    82     // Retrieve the preview for the type selected, using the now up-to-date gallery configuration.
    83     ob_start();
    84     do_action( 'envira_gallery_preview_' . $type, $data );
    85     $html = ob_get_clean();
    86 
    87     // Send back the response.
    88     echo wp_json_encode( $html );
    89     die;
    90 }
    91 
    92 add_action( 'wp_ajax_envira_gallery_set_user_setting', 'envira_gallery_ajax_set_user_setting' );
    93 /**
    94  * Stores a user setting for the logged in WordPress User
    95  *
    96  * @since 1.5.0
    97  */
    9853function envira_gallery_ajax_set_user_setting() {
    9954
    10055    // Run a security check first.
    10156    check_admin_referer( 'envira-gallery-set-user-setting', 'nonce' );
     57
     58    if ( ! current_user_can( 'edit_posts' ) ) {
     59        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     60    }
    10261
    10362    // Prepare variables.
    … …  
    12382    // Run a security check first.
    12483    check_admin_referer( 'envira-gallery-load-image', 'nonce' );
     84
     85    if ( ! current_user_can( 'edit_posts' ) ) {
     86        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     87    }
    12588
    12689    // Prepare variables.
    … …  
    188151    check_admin_referer( 'envira-gallery-insert-images', 'nonce' );
    189152
     153    if ( ! current_user_can( 'edit_posts' ) ) {
     154        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     155    }
     156
    190157    // Prepare variables.
    191158    $images = [];
    … …  
    268235    // Run a security check first.
    269236    check_admin_referer( 'envira-gallery-sort', 'nonce' );
     237
     238    if ( ! current_user_can( 'edit_posts' ) ) {
     239        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     240    }
    270241
    271242    // Prepare variables.
    … …  
    305276    // Run a security check first.
    306277    check_admin_referer( 'envira-gallery-remove-image', 'nonce' );
     278
     279    if ( ! current_user_can( 'edit_posts' ) ) {
     280        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     281    }
    307282
    308283    // Prepare variables.
    … …  
    351326    check_admin_referer( 'envira-gallery-remove-image', 'nonce' );
    352327
     328    if ( ! current_user_can( 'edit_posts' ) ) {
     329        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     330    }
     331
     332
    353333    // Prepare variables.
    354334    $post_id      = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    401381    // Run a security check first.
    402382    check_ajax_referer( 'envira-gallery-save-meta', 'nonce' );
     383
     384    if ( ! current_user_can( 'edit_posts' ) ) {
     385        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     386    }
    403387
    404388    // Prepare variables.
    … …  
    486470    check_admin_referer( 'envira-gallery-save-meta', 'nonce' );
    487471
     472    if ( ! current_user_can( 'edit_posts' ) ) {
     473        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     474    }
     475
    488476    // Prepare variables.
    489477    $post_id   = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    562550    check_admin_referer( 'envira-gallery-refresh', 'nonce' );
    563551
     552    if ( ! current_user_can( 'edit_posts' ) ) {
     553        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     554    }
     555
    564556    // Prepare variables.
    565557    $post_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : null;
    … …  
    585577
    586578add_action( 'wp_ajax_envira_gallery_load_gallery_data', 'envira_gallery_ajax_load_gallery_data' );
     579
    587580/**
    588581 * Retrieves and return gallery data for the specified ID.
    … …  
    591584 */
    592585function envira_gallery_ajax_load_gallery_data() {
     586
     587    if ( ! current_user_can( 'edit_posts' ) ) {
     588        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     589    }
    593590
    594591    // Prepare variables and grab the gallery data.
    … …  
    611608    // Run a security check first.
    612609    check_admin_referer( 'envira-gallery-install', 'nonce' );
     610
     611    if ( ! current_user_can( 'install_plugins' ) ) {
     612        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'envira-gallery-lite' ) ] );
     613    }
    613614
    614615    // Install the addon.
    … …  
    672673    check_admin_referer( 'envira-gallery-activate', 'nonce' );
    673674
     675    if ( ! current_user_can( 'activate_plugins' ) ) {
     676        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to activate plugins.', 'envira-gallery-lite' ) ] );
     677    }
     678
    674679    // Activate the addon.
    675680    if ( isset( $_POST['plugin'] ) ) {
    … …  
    696701    // Run a security check first.
    697702    check_admin_referer( 'envira-gallery-deactivate', 'nonce' );
     703
     704    if ( ! current_user_can( 'activate_plugins' ) ) {
     705        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'envira-gallery-lite' ) ] );
     706    }
    698707
    699708    // Deactivate the addon.
    … …  
    780789    check_admin_referer( 'envira-gallery-dismiss-notice', 'nonce' );
    781790
     791    if ( ! current_user_can( 'edit_dashboard' ) ) {
     792        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to dismiss notices.', 'envira-gallery-lite' ) ] );
     793    }
     794
    782795    // Deactivate the notice.
    783796    if ( isset( $_POST['notice'] ) ) {
    … …  
    807820    // Run a security check first.
    808821    check_admin_referer( 'envira-gallery-dismiss-topbar', 'nonce' );
     822
     823    if ( ! current_user_can( 'edit_dashboard' ) ) {
     824        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to dismiss notices.', 'envira-gallery-lite' ) ] );
     825    }
     826
    809827    update_option( 'envira_pro_upgrade_header_dismissed', true );
    810828
    … …  
    823841    // Check nonce.
    824842    check_ajax_referer( 'envira-gallery-save-meta', 'nonce' );
     843
     844    if ( ! current_user_can( 'edit_posts' ) ) {
     845        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     846    }
     847
    825848
    826849    // Get required inputs.
    … …  
    847870    // Check nonce.
    848871    check_admin_referer( 'envira-gallery-editor-get-galleries', 'nonce' );
     872
     873    if ( ! current_user_can( 'edit_posts' ) ) {
     874        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit galleries.', 'envira-gallery-lite' ) ] );
     875    }
     876
    849877
    850878    // Get POSTed fields.
    … …  
    945973    check_admin_referer( 'envira-gallery-move-media', 'nonce' );
    946974
     975    if ( ! current_user_can( 'edit_posts' ) ) {
     976        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to move media.', 'envira-gallery-lite' ) ] );
     977    }
     978
    947979    // Get POSTed fields.
    948980    $from_gallery_id = isset( $_POST['from_gallery_id'] ) ? absint( $_POST['from_gallery_id'] ) : null;
    … …  
    9991031    check_admin_referer( 'envira-gallery-activate-partner', 'nonce' );
    10001032
     1033    if ( ! current_user_can( 'activate_plugins' ) ) {
     1034        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to activate plugins.', 'envira-gallery-lite' ) ] );
     1035    }
     1036
    10011037    // Activate the addon.
    10021038    if ( isset( $_POST['basename'] ) ) {
    1003         $activate = activate_plugin( wp_unslash( $_POST['basename'] ) );  // @codingStandardsIgnoreLine
     1039        $activate = activate_plugin( sanitize_text_field( wp_unslash( $_POST['basename'] ) ) );
    10041040
    10051041        if ( is_wp_error( $activate ) ) {
    … …  
    10261062    check_admin_referer( 'envira-gallery-deactivate-partner', 'nonce' );
    10271063
     1064    if ( ! current_user_can( 'activate_plugins' ) ) {
     1065        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'envira-gallery-lite' ) ] );
     1066    }
     1067
    10281068    // Deactivate the addon.
    10291069    if ( isset( $_POST['basename'] ) ) {
    … …  
    10461086
    10471087    check_admin_referer( 'envira-gallery-install-partner', 'nonce' );
     1088
     1089    if ( ! current_user_can( 'install_plugins' ) ) {
     1090        wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'envira-gallery-lite' ) ] );
     1091    }
     1092
    10481093    // Install the addon.
    10491094    if ( isset( $_POST['download_url'] ) ) {
    … …  
    10551100        set_current_screen();
    10561101
    1057         // Prepare variables.
    10581102        $method = '';
    1059         $url    = add_query_arg(
    1060             [
    1061                 'page' => 'pdfemb_list_options',
    1062             ],
    1063             admin_url( 'options-general.php' )
    1064         );
    1065         $url    = esc_url( $url );
     1103        $url    = esc_url( admin_url( 'edit.php?post_type=envira&page=envira-gallery-lite-about-us' ) );
    10661104
    10671105        // Start output bufferring to catch the filesystem form if credentials are needed.
    … …  
    11841222    // Start output bufferring to catch the filesystem form if credentials are needed.
    11851223    ob_start();
     1224
     1225    $method = '';
     1226    $url    = esc_url( admin_url( 'edit.php?post_type=envira&page=envira-gallery-lite-about-us' ) );
     1227
    11861228    $creds = request_filesystem_credentials( $url, $method, false, false, null );
    11871229    if ( false === $creds ) {

  • envira-gallery-lite/trunk/includes/admin/common.php

    r2993297 r2996579  
    135135     */
    136136    public function add_upgrade_menu_item() {
     137
    137138        global $submenu;
    138139
    … …  
    144145            esc_url( $this->get_upgrade_link( 'http://enviragallery.com/lite/', 'adminsidebar', 'unlockprosidebar' ) )
    145146        );
     147
     148        if ( ! current_user_can( 'manage_options' ) ) {
     149            return;
     150        }
    146151
    147152        $upgrade_link_position = key(

  • envira-gallery-lite/trunk/includes/admin/metaboxes.php

    r2993297 r2996579  
    551551            ]
    552552        );
    553     }
    554 
    555     /**
    556      * Callback for displaying the Preview metabox.
    557      *
    558      * @since 1.5.0
    559      *
    560      * @param object $post The current post object.
    561      */
    562     public function meta_box_preview_callback( $post ) {
    563 
    564         // Get the gallery data.
    565         $data = get_post_meta( $post->ID, '_eg_gallery_data', true );
    566 
    567         // Output the display based on the type of slider being created.
    568         echo '<div id="envira-gallery-preview-main" class="envira-clear">';
    569 
    570         $this->preview_display( $this->get_config( 'type', $this->get_config_default( 'type' ) ), $data );
    571 
    572         echo '</div>
    573               <div class="spinner"></div>';
    574553    }
    575554

  • envira-gallery-lite/trunk/readme.txt

    r2993297 r2996579  
    55Tested up to: 6.4.1
    66Requires PHP: 5.6
    7 Stable tag: 1.8.7
     7Stable tag: 1.8.7.1
    88License: GNU General Public License v2.0 or later
    99
    … …  
    210210== Changelog ==
    211211
     2121.8.7.1
     213
     214* Fixed: Notices for non-admin users in admin.
     215* Fixed: Capability checks for ajax calls
     216
    2122171.8.7
    213218
Note: See TracChangeset for help on using the changeset viewer.