add capability checks for other ajax callbacks

Author: ilicfilip

classes/actions/class-content-scan.php

@@ -45,6 +45,11 @@ public function register_hooks() {
 	 * @return void
 	 */
 	public function ajax_scan() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to scan posts.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );
@@ -71,6 +76,11 @@ public function ajax_scan() {
 	 * @return void
 	 */
 	public function ajax_reset_posts_data() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to reset posts data.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/admin/class-page-settings.php

@@ -128,6 +128,11 @@ public function should_show_setting( $page_type ) {
 	 * @return void
 	 */
 	public function store_settings_form_options() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/class-suggested-tasks.php

@@ -232,6 +232,16 @@ public function suggested_task_action() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Task not found.', 'progress-planner' ) ] );
 		}
 
+		$provider = \progress_planner()->get_suggested_tasks()->get_tasks_manager()->get_task_provider( $task->get_provider_id() );
+
+		if ( ! $provider ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'Provider not found.', 'progress-planner' ) ] );
+		}
+
+		if ( ! $provider->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to complete this task.', 'progress-planner' ) ] );
+		}
+
 		$updated = false;
 
 		switch ( $action ) {

classes/suggested-tasks/providers/class-email-sending.php

@@ -255,6 +255,11 @@ protected function is_there_sending_email_override() {
 	 * @return void
 	 */
 	public function ajax_test_email_sending() {
+
+		if ( ! $this->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/utils/class-onboard.php

@@ -58,6 +58,11 @@ public function on_activate_plugin( $plugin ) {
 	 * @return void
 	 */
 	public function save_onboard_response() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );