WordPress.org
Get WordPress

Plugin Directory

Changeset 3395024


Ignore:
Timestamp:
11/13/2025 12:25:16 PM (5 months ago)
Author:
leopardhost
Message:

v2.0.5: Protected Actions

Location:
tnc-toolbox
Files:
18 added
4 edited

Legend:

Unmodified
Added
Removed

  • tnc-toolbox/trunk/core/core.php

    r3391021 r3395024  
    6262        add_action('admin_post_nginx_cache_purge', array($this, 'nginx_cache_purge'));
    6363        add_action('post_updated', array($this, 'purge_cache_on_update'), 10, 3);
    64         add_action('_core_updated_successfully', array($this, 'nginx_cache_purge'));
     64        add_action('_core_updated_successfully', function() { TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache', [], true); });
    6565
    6666        // Notices (Admin GUI)
    … …  
    6969        // ACF Save (#24)
    7070        if (has_action('acf/options_page/save') === true) {
    71             add_action('acf/options_page/save', TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache'), 10, 3);
     71            add_action('acf/options_page/save', function() { TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache', [], true); }, 10, 3);
    7272        }
    7373    }
    … …  
    7777     */
    7878    public function add_capability_dependent_hooks() {
    79         if (current_user_can('update_core')) {
     79        if (current_user_can('manage_options')) {
    8080            add_action('admin_bar_menu', array($this, 'add_cache_off_button'), 100);
    8181            add_action('admin_post_nginx_cache_off', array($this, 'nginx_cache_off'));
    … …  
    209209    public function nginx_cache_purge() {
    210210        check_admin_referer('nginx_cache_purge');
     211        if (!current_user_can('manage_options')) {
     212            wp_die(__('You are not allowed to do that.'));
     213        }
    211214        $response = TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache');
    212215        $this->set_notice(
    … …  
    224227    public function nginx_cache_off() {
    225228        check_admin_referer('nginx_cache_off');
     229        if (!current_user_can('manage_options')) {
     230            wp_die(__('You are not allowed to do that.'));
     231        }
    226232        $response = TNC_cPanel_UAPI::make_api_request('NginxCaching/disable_cache');
    227233        $this->set_notice(
    … …  
    239245    public function nginx_cache_on() {
    240246        check_admin_referer('nginx_cache_on');
     247        if (!current_user_can('manage_options')) {
     248            wp_die(__('You are not allowed to do that.'));
     249        }
    241250        $response = TNC_cPanel_UAPI::make_api_request('NginxCaching/enable_cache');
    242251        $this->set_notice(
    … …  
    259268            ($post_before->post_status === 'publish' && $post_after->post_status !== 'trash')) {
    260269            // Use the UAPI directly rather than function, to support automated (#31)
    261             TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache');
     270            TNC_cPanel_UAPI::make_api_request('NginxCaching/clear_cache', [], true);
    262271        }
    263272    }

  • tnc-toolbox/trunk/readme.txt

    r3394702 r3395024  
    66Tags: NGINX, Cache Purge, Web Performance, Automatic Purge, Freeware
    77Tested up to: 6.8
    8 Stable tag: 2.0.4
     8Stable tag: 2.0.5
    99License: GPLv3
    1010License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    113113== Changelog ==
    114114
     115= 2.0.5: Nov 13, 2025 =
     116* Security: Restrict actions to Cron/Hook & via Perms
     117
    115118= 2.0.4: Nov 11, 2025 =
    116119* Remove minimum requirements: Ensure v2 adoption growth

  • tnc-toolbox/trunk/tnc-toolbox.php

    r3393408 r3395024  
    66 * @author            The Network Crew Pty Ltd (TNC & Co.)
    77 * @license           gplv3
    8  * @version           2.0.4
     8 * @version           2.0.5
    99 *
    1010 * @wordpress-plugin
    … …  
    1212 * Plugin URI:        https://merlot.digital
    1313 * Description:       Adds functionality to WP - designed for NGINX-powered Servers on cPanel+WHM. Made to help you fly online!
    14  * Version:           2.0.4
     14 * Version:           2.0.5
    1515 * Author:            The Network Crew Pty Ltd (TNC & Co.)
    1616 * Author URI:        https://tnc.works
    … …  
    3030
    3131// Plugin version
    32 define('TNCTOOLBOX_VERSION', '2.0.4');
     32define('TNCTOOLBOX_VERSION', '2.0.5');
    3333
    3434// Plugin Root File

  • tnc-toolbox/trunk/vendor/cpanel-uapi.php

    r3393408 r3395024  
    4848     * Get stored API configuration
    4949     *
     50     * @param bool $skip_cap_check Skip capability check for internal requests
    5051     * @return array|false API config, or false if not set
    5152     */
    52     public static function get_config() {
    53         // Cleanly return if user can't edit post
    54         if (!current_user_can('manage_options')) {
     53    public static function get_config($skip_cap_check = false) {
     54        // Cleanly return if user can't edit post and not skipping check
     55        if (!$skip_cap_check && !current_user_can('manage_options')) {
    5556            return false;
    5657        }
    … …  
    101102     * @param string $endpoint API endpoint (e.g. 'NginxCaching/clear_cache')
    102103     * @param array $body Request body parameters
     104     * @param bool $skip_cap_check Skip capability check for internal requests
    103105     * @return array Response data array with 'success', 'message', and optional 'data'
    104106     */
    105     public static function make_api_request($endpoint, $body = []) {
     107    public static function make_api_request($endpoint, $body = [], $skip_cap_check = false) {
    106108        try {
    107             $config = self::get_config();
     109            $config = self::get_config($skip_cap_check);
    108110            if (!$config) {
    109111                self::log_error('API configuration not set');
Note: See TracChangeset for help on using the changeset viewer.