Skip to content

Enhanced permission checks for import actions - #1294

Open
girishpanchal30 wants to merge 2 commits into
developmentfrom
bugfix/pro/1006
Open

Enhanced permission checks for import actions#1294
girishpanchal30 wants to merge 2 commits into
developmentfrom
bugfix/pro/1006

Conversation

@girishpanchal30

Copy link
Copy Markdown
Contributor

Summary

Checked the ownership of the import job before performing any action on it.

Check before Pull Request is ready:

Closes https://github.com/Codeinwp/feedzy-rss-feeds-pro/issues/1006

@pirate-bot pirate-bot added the pr-checklist-complete The Pull Request checklist is complete. (automatic label) label Jul 27, 2026
@pirate-bot

pirate-bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Plugin build for a6d4bec is ready 🛎️!

Note

You can preview the changes in the Playground

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds ownership-aware authorization for import-management actions.

Changes:

  • Guards status, run, purge, and log-clearing actions.
  • Hides unauthorized controls and handles AJAX failures.
  • Adds ownership tests and updates PHPStan baseline.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File Description
includes/admin/feedzy-rss-feeds-import.php Adds import authorization checks.
includes/views/js/import-metabox-edit.js Updates permission-aware UI behavior.
tests/test-import.php Adds AJAX authorization tests.
phpstan-baseline.neon Removes resolved type exceptions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +1318 to +1319
if ( ! current_user_can( 'edit_post', $import_id ) ) {
return false;

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If capabilities is empty and map_meta_cap isn't set, and capability_type is 'post' or 'page' (as it is here), WordPress's back-compat handling automatically sets map_meta_cap to true - so the meta capabilities (edit_post, delete_post, etc.) are mapped to the owner/others primitive caps as usual. feedzy_imports meets all three conditions, so this applies without any change needed.

Comment thread includes/views/js/import-metabox-edit.js
Comment thread includes/admin/feedzy-rss-feeds-import.php
Comment thread includes/admin/feedzy-rss-feeds-import.php
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr-checklist-complete The Pull Request checklist is complete. (automatic label)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants