Enhanced permission checks for import actions - #1294
Conversation
|
Plugin build for a6d4bec is ready 🛎️!
Note You can preview the changes in the Playground |
There was a problem hiding this comment.
Pull request overview
Adds ownership-aware authorization for import-management actions.
Changes:
- Guards status, run, purge, and log-clearing actions.
- Hides unauthorized controls and handles AJAX failures.
- Adds ownership tests and updates PHPStan baseline.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
includes/admin/feedzy-rss-feeds-import.php |
Adds import authorization checks. |
includes/views/js/import-metabox-edit.js |
Updates permission-aware UI behavior. |
tests/test-import.php |
Adds AJAX authorization tests. |
phpstan-baseline.neon |
Removes resolved type exceptions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if ( ! current_user_can( 'edit_post', $import_id ) ) { | ||
| return false; |
There was a problem hiding this comment.
If capabilities is empty and map_meta_cap isn't set, and capability_type is 'post' or 'page' (as it is here), WordPress's back-compat handling automatically sets map_meta_cap to true - so the meta capabilities (edit_post, delete_post, etc.) are mapped to the owner/others primitive caps as usual. feedzy_imports meets all three conditions, so this applies without any change needed.
Summary
Checked the ownership of the import job before performing any action on it.
Check before Pull Request is ready:
Closes https://github.com/Codeinwp/feedzy-rss-feeds-pro/issues/1006