Merge branch 'main' into develop

Author: aristath

classes/admin/class-page-settings.php

@@ -133,6 +133,13 @@ public function store_settings_form_options() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
 		}
 
+		// Check the nonce.
+		\check_admin_referer( 'progress_planner' );
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Use check_ajax_referer instead of check_admin_referer for AJAX handlers.
 		// check_admin_referer is designed for form submissions, not AJAX requests.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {

classes/suggested-tasks/providers/class-email-sending.php

@@ -263,6 +263,13 @@ public function ajax_test_email_sending() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
 		}
 
+		// Check the nonce.
+		\check_admin_referer( 'progress_planner' );
+
+		if ( ! $this->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
+		}
+
 		// Use check_ajax_referer for AJAX handlers.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );