Skip to content

Commit f681d3c

Browse files
refactor: restrict database query action to admins
1 parent 7ccd6fe commit f681d3c

1 file changed

Lines changed: 2 additions & 5 deletions

File tree

classes/Visualizer/Module/AIBuilder.php

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -365,11 +365,8 @@ public function uploadData(): void {
365365

366366
// ── Database query ────────────────────────────────────────────────
367367
case 'db_query':
368-
if ( ! current_user_can( 'administrator' ) ) {
369-
wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
370-
}
371-
if ( ! is_super_admin() ) {
372-
wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
368+
if ( ! current_user_can( 'manage_options' ) && ! is_super_admin() ) {
369+
wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ), 403 );
373370
}
374371
if ( empty( $_POST['db_query'] ) ) {
375372
wp_send_json_error( array( 'message' => __( 'No query provided.', 'visualizer' ) ) );

0 commit comments

Comments
 (0)