WordPress.org
Get WordPress

Plugin Directory

Changeset 2996581


Ignore:
Timestamp:
11/15/2023 04:57:08 PM (2 years ago)
Author:
chrisakelley
Message:

Release 2.7.4.1

Location:
soliloquy-lite
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • soliloquy-lite/tags/2.7.4.1/includes/admin/ajax.php

    r2993325 r2996581  
    8080        check_admin_referer( 'soliloquy-save-meta', 'nonce' );
    8181
     82        if ( ! current_user_can( 'edit_posts' ) ) {
     83            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     84        }
     85
    8286        // Get required inputs.
    8387        $attachment_id = isset( $_POST['attachment_id'] ) ? absint( wp_unslash( $_POST['attachment_id'] ) ) : false;
    … …  
    103107        // Run a security check first.
    104108        check_ajax_referer( 'soliloquy-upgrade', 'nonce' );
     109
     110        if ( ! current_user_can( 'edit_posts' ) ) {
     111            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     112        }
    105113
    106114        // Increase the time limit to account for large slider sets and suspend cache invalidations.
    … …  
    232240        check_ajax_referer( 'soliloquy-is-hosted', 'nonce' );
    233241
     242        if ( ! current_user_can( 'edit_posts' ) ) {
     243            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     244        }
     245
    234246        // Setup vars.
    235247        $video_url = ( isset( $_POST['video_url'] ) ? sanitize_text_field( wp_unslash( $_POST['video_url'] ) ) : '' );
    … …  
    280292        check_ajax_referer( 'soliloquy-change-type', 'nonce' );
    281293
     294        if ( ! current_user_can( 'edit_posts' ) ) {
     295            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     296        }
     297
    282298        // Prepare variables.
    283299        $post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : '';
    … …  
    308324    public function load_image() {
    309325
    310         if ( ! current_user_can( 'upload_files' ) ) {
    311             die();
    312         }
    313 
    314326        // Run a security check first.
    315327        check_ajax_referer( 'soliloquy-load-image', 'nonce' );
     328
     329        if ( ! current_user_can( 'edit_posts' ) ) {
     330            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     331        }
    316332
    317333        // Prepare variables.
    … …  
    372388    public function insert_slides() {
    373389
    374         if ( ! current_user_can( 'upload_files' ) ) {
    375             die();
    376         }
    377390        // Run a security check first.
    378391        check_ajax_referer( 'soliloquy-insert-images', 'nonce' );
     392
     393        if ( ! current_user_can( 'edit_posts' ) ) {
     394            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     395        }
    379396
    380397        // Prepare variables.
    … …  
    481498        check_ajax_referer( 'soliloquy-sort', 'nonce' );
    482499
     500        if ( ! current_user_can( 'edit_posts' ) ) {
     501            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     502        }
     503
    483504        // Prepare variables.
    484505        $order       = isset( $_POST['order'] ) ? explode( ',', wp_unslash( $_POST['order'] ) ) : array(); //@codingStandardsIgnoreLine
    … …  
    515536        // Run a security check first.
    516537        check_ajax_referer( 'soliloquy-remove-slide', 'nonce' );
     538
     539        if ( ! current_user_can( 'edit_posts' ) ) {
     540            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     541        }
    517542
    518543        // Prepare variables.
    … …  
    567592        // Run a security check first.
    568593        check_ajax_referer( 'soliloquy-remove-slide', 'nonce' );
     594
     595        if ( ! current_user_can( 'edit_posts' ) ) {
     596            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     597        }
    569598
    570599        // Prepare variables.
    … …  
    613642        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
    614643
     644        if ( ! current_user_can( 'edit_posts' ) ) {
     645            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     646        }
     647
    615648        // Prepare variables.
    616649        $post_id     = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : false;
    … …  
    683716        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
    684717
     718        if ( ! current_user_can( 'edit_posts' ) ) {
     719            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     720        }
     721
    685722        // Prepare variables.
    686723        $post_id   = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : false;
    … …  
    759796        // Run a security check first.
    760797        check_ajax_referer( 'soliloquy-refresh', 'nonce' );
     798
     799        if ( ! current_user_can( 'edit_posts' ) ) {
     800            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     801        }
    761802
    762803        // Prepare variables.
    … …  
    946987        // Run a security check first.
    947988        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
     989
     990        if ( ! current_user_can( 'edit_posts' ) ) {
     991            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     992        }
     993
    948994        $post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : false;
    949995        $view    = isset( $_POST['view'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['view'] ) ) ) : false;
    … …  
    9811027        // Run a security check first.
    9821028        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
     1029
     1030        if ( ! current_user_can( 'edit_posts' ) ) {
     1031            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     1032        }
    9831033
    9841034        // Prepare variables.
    … …  
    10751125        check_admin_referer( 'soliloquy-activate-partner', 'nonce' );
    10761126
     1127        if ( ! current_user_can( 'activate_plugins' ) ) {
     1128            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'soliloquy' ) ] );
     1129        }
     1130
    10771131        // Activate the addon.
    10781132        if ( isset( $_POST['basename'] ) ) {
    … …  
    10991153        check_admin_referer( 'soliloquy-deactivate-partner', 'nonce' );
    11001154
     1155        if ( ! current_user_can( 'activate_plugins' ) ) {
     1156            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'soliloquy' ) ] );
     1157        }
     1158
    11011159        // Deactivate the addon.
    11021160        if ( isset( $_POST['basename'] ) ) {
    … …  
    11171175        check_admin_referer( 'soliloquy-install-partner', 'nonce' );
    11181176
     1177        if ( ! current_user_can( 'install_plugins' ) ) {
     1178            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'soliloquy' ) ] );
     1179        }
     1180
    11191181        // Install the addon.
    11201182        if ( isset( $_POST['download_url'] ) ) {
    … …  
    11251187            // Set the current screen to avoid undefined notices.
    11261188            set_current_screen();
     1189
     1190            $method = '';
     1191            $url    = esc_url( admin_url( 'edit.php?post_type=soliloquy&page=soliloquy-lite-about-us' ) );
    11271192
    11281193            // Start output bufferring to catch the filesystem form if credentials are needed.
    … …  
    12391304        // Start output bufferring to catch the filesystem form if credentials are needed.
    12401305        ob_start();
     1306
     1307        $method = '';
     1308        $url    = esc_url_raw( admin_url( 'edit.php?post_type=soliloquy&page=soliloquy-lite-about-us' ) );
     1309
    12411310        $creds = request_filesystem_credentials( $url, $method, false, false, null );
    12421311        if ( false === $creds ) {

  • soliloquy-lite/tags/2.7.4.1/includes/admin/common.php

    r2993325 r2996581  
    198198            esc_url( $this->get_upgrade_link( 'http://soliloquywp.com/lite/', 'adminsidebar', 'unlockprosidebar' ) )
    199199        );
     200
     201        if ( ! current_user_can( 'manage_options' ) ) {
     202            return;
     203        }
    200204
    201205        $upgrade_link_position = key(

  • soliloquy-lite/tags/2.7.4.1/readme.txt

    r2993325 r2996581  
    55Tested up to: 6.4.1
    66Requires PHP: 5.6
    7 Stable tag: 2.7.4
     7Stable tag: 2.7.4.1
    88License: GNU General Public License v2.0 or later
    99
    … …  
    259259
    260260== Changelog ==
     261= 2.7.4.1 =
     262* Fixed: Notices for non-admin users in admin.
     263* Fixed: Capability checks for ajax calls
    261264
    262265= 2.7.4 =

  • soliloquy-lite/tags/2.7.4.1/soliloquy-lite.php

    r2993325 r2996581  
    66 * Author:      Soliloquy Team
    77 * Author URI:  https://soliloquywp.com
    8  * Version:     2.7.4
     8 * Version:     2.7.4.1
    99 * Text Domain: soliloquy
    1010 * Domain Path: languages
    … …  
    5757     * @var string
    5858     */
    59     public $version = '2.7.4';
     59    public $version = '2.7.4.1';
    6060
    6161    /**

  • soliloquy-lite/trunk/includes/admin/ajax.php

    r2993325 r2996581  
    8080        check_admin_referer( 'soliloquy-save-meta', 'nonce' );
    8181
     82        if ( ! current_user_can( 'edit_posts' ) ) {
     83            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     84        }
     85
    8286        // Get required inputs.
    8387        $attachment_id = isset( $_POST['attachment_id'] ) ? absint( wp_unslash( $_POST['attachment_id'] ) ) : false;
    … …  
    103107        // Run a security check first.
    104108        check_ajax_referer( 'soliloquy-upgrade', 'nonce' );
     109
     110        if ( ! current_user_can( 'edit_posts' ) ) {
     111            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     112        }
    105113
    106114        // Increase the time limit to account for large slider sets and suspend cache invalidations.
    … …  
    232240        check_ajax_referer( 'soliloquy-is-hosted', 'nonce' );
    233241
     242        if ( ! current_user_can( 'edit_posts' ) ) {
     243            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     244        }
     245
    234246        // Setup vars.
    235247        $video_url = ( isset( $_POST['video_url'] ) ? sanitize_text_field( wp_unslash( $_POST['video_url'] ) ) : '' );
    … …  
    280292        check_ajax_referer( 'soliloquy-change-type', 'nonce' );
    281293
     294        if ( ! current_user_can( 'edit_posts' ) ) {
     295            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     296        }
     297
    282298        // Prepare variables.
    283299        $post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : '';
    … …  
    308324    public function load_image() {
    309325
    310         if ( ! current_user_can( 'upload_files' ) ) {
    311             die();
    312         }
    313 
    314326        // Run a security check first.
    315327        check_ajax_referer( 'soliloquy-load-image', 'nonce' );
     328
     329        if ( ! current_user_can( 'edit_posts' ) ) {
     330            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     331        }
    316332
    317333        // Prepare variables.
    … …  
    372388    public function insert_slides() {
    373389
    374         if ( ! current_user_can( 'upload_files' ) ) {
    375             die();
    376         }
    377390        // Run a security check first.
    378391        check_ajax_referer( 'soliloquy-insert-images', 'nonce' );
     392
     393        if ( ! current_user_can( 'edit_posts' ) ) {
     394            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     395        }
    379396
    380397        // Prepare variables.
    … …  
    481498        check_ajax_referer( 'soliloquy-sort', 'nonce' );
    482499
     500        if ( ! current_user_can( 'edit_posts' ) ) {
     501            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     502        }
     503
    483504        // Prepare variables.
    484505        $order       = isset( $_POST['order'] ) ? explode( ',', wp_unslash( $_POST['order'] ) ) : array(); //@codingStandardsIgnoreLine
    … …  
    515536        // Run a security check first.
    516537        check_ajax_referer( 'soliloquy-remove-slide', 'nonce' );
     538
     539        if ( ! current_user_can( 'edit_posts' ) ) {
     540            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     541        }
    517542
    518543        // Prepare variables.
    … …  
    567592        // Run a security check first.
    568593        check_ajax_referer( 'soliloquy-remove-slide', 'nonce' );
     594
     595        if ( ! current_user_can( 'edit_posts' ) ) {
     596            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     597        }
    569598
    570599        // Prepare variables.
    … …  
    613642        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
    614643
     644        if ( ! current_user_can( 'edit_posts' ) ) {
     645            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     646        }
     647
    615648        // Prepare variables.
    616649        $post_id     = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : false;
    … …  
    683716        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
    684717
     718        if ( ! current_user_can( 'edit_posts' ) ) {
     719            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     720        }
     721
    685722        // Prepare variables.
    686723        $post_id   = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : false;
    … …  
    759796        // Run a security check first.
    760797        check_ajax_referer( 'soliloquy-refresh', 'nonce' );
     798
     799        if ( ! current_user_can( 'edit_posts' ) ) {
     800            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     801        }
    761802
    762803        // Prepare variables.
    … …  
    946987        // Run a security check first.
    947988        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
     989
     990        if ( ! current_user_can( 'edit_posts' ) ) {
     991            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     992        }
     993
    948994        $post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : false;
    949995        $view    = isset( $_POST['view'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['view'] ) ) ) : false;
    … …  
    9811027        // Run a security check first.
    9821028        check_ajax_referer( 'soliloquy-save-meta', 'nonce' );
     1029
     1030        if ( ! current_user_can( 'edit_posts' ) ) {
     1031            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to edit sliders.', 'soliloquy' ) ] );
     1032        }
    9831033
    9841034        // Prepare variables.
    … …  
    10751125        check_admin_referer( 'soliloquy-activate-partner', 'nonce' );
    10761126
     1127        if ( ! current_user_can( 'activate_plugins' ) ) {
     1128            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'soliloquy' ) ] );
     1129        }
     1130
    10771131        // Activate the addon.
    10781132        if ( isset( $_POST['basename'] ) ) {
    … …  
    10991153        check_admin_referer( 'soliloquy-deactivate-partner', 'nonce' );
    11001154
     1155        if ( ! current_user_can( 'activate_plugins' ) ) {
     1156            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to deactivate plugins.', 'soliloquy' ) ] );
     1157        }
     1158
    11011159        // Deactivate the addon.
    11021160        if ( isset( $_POST['basename'] ) ) {
    … …  
    11171175        check_admin_referer( 'soliloquy-install-partner', 'nonce' );
    11181176
     1177        if ( ! current_user_can( 'install_plugins' ) ) {
     1178            wp_send_json_error( [ 'message' => esc_html__( 'You are not allowed to install plugins.', 'soliloquy' ) ] );
     1179        }
     1180
    11191181        // Install the addon.
    11201182        if ( isset( $_POST['download_url'] ) ) {
    … …  
    11251187            // Set the current screen to avoid undefined notices.
    11261188            set_current_screen();
     1189
     1190            $method = '';
     1191            $url    = esc_url( admin_url( 'edit.php?post_type=soliloquy&page=soliloquy-lite-about-us' ) );
    11271192
    11281193            // Start output bufferring to catch the filesystem form if credentials are needed.
    … …  
    12391304        // Start output bufferring to catch the filesystem form if credentials are needed.
    12401305        ob_start();
     1306
     1307        $method = '';
     1308        $url    = esc_url_raw( admin_url( 'edit.php?post_type=soliloquy&page=soliloquy-lite-about-us' ) );
     1309
    12411310        $creds = request_filesystem_credentials( $url, $method, false, false, null );
    12421311        if ( false === $creds ) {

  • soliloquy-lite/trunk/includes/admin/common.php

    r2993325 r2996581  
    198198            esc_url( $this->get_upgrade_link( 'http://soliloquywp.com/lite/', 'adminsidebar', 'unlockprosidebar' ) )
    199199        );
     200
     201        if ( ! current_user_can( 'manage_options' ) ) {
     202            return;
     203        }
    200204
    201205        $upgrade_link_position = key(

  • soliloquy-lite/trunk/readme.txt

    r2993325 r2996581  
    55Tested up to: 6.4.1
    66Requires PHP: 5.6
    7 Stable tag: 2.7.4
     7Stable tag: 2.7.4.1
    88License: GNU General Public License v2.0 or later
    99
    … …  
    259259
    260260== Changelog ==
     261= 2.7.4.1 =
     262* Fixed: Notices for non-admin users in admin.
     263* Fixed: Capability checks for ajax calls
    261264
    262265= 2.7.4 =

  • soliloquy-lite/trunk/soliloquy-lite.php

    r2993325 r2996581  
    66 * Author:      Soliloquy Team
    77 * Author URI:  https://soliloquywp.com
    8  * Version:     2.7.4
     8 * Version:     2.7.4.1
    99 * Text Domain: soliloquy
    1010 * Domain Path: languages
    … …  
    5757     * @var string
    5858     */
    59     public $version = '2.7.4';
     59    public $version = '2.7.4.1';
    6060
    6161    /**
Note: See TracChangeset for help on using the changeset viewer.