Development - #1356
Merged
Merged
Conversation
Save the active database query before the chart form closes so one-time imports cannot retain stale preview data. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for the query editor to initialize before opening it, navigate to the chart post via ?p= so the check works under any permalink structure, and retry the front-end chart assertion since chart scripts lazy-load on user interaction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The chart_data REST field callback only checked the generic edit_posts
capability, so any contributor could read the full backend configuration
of any chart (data source query, settings, JSON endpoint auth headers)
via GET /wp-json/wp/v2/visualizer/{id}.
Check edit_post on the requested chart instead, so access follows the
standard post capability map (author or edit_others_posts).
Fixes Codeinwp/visualizer-pro#605
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Charts are force-published on save, and Contributors lack edit_published_posts, so a bare edit_post check locks chart authors out of their own charts in the Gutenberg block. Use the existing Visualizer_Module::can_edit_chart() helper, which allows the chart owner with edit_posts while still rejecting other users' charts. Covers Copilot review feedback on #1348. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.1.54 to 2.2.6. - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.2.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1350) Bumps [wp-coding-standards/wpcs](https://github.com/WordPress/WordPress-Coding-Standards) from 3.3.0 to 3.4.1. - [Release notes](https://github.com/WordPress/WordPress-Coding-Standards/releases) - [Changelog](https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/CHANGELOG.md) - [Commits](WordPress/WordPress-Coding-Standards@3.3.0...3.4.1) --- updated-dependencies: - dependency-name: wp-coding-standards/wpcs dependency-version: 3.4.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.55 to 3.3.57. - [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases) - [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.57/CHANGELOG.md) - [Commits](Codeinwp/themeisle-sdk@v3.3.55...v3.3.57) --- updated-dependencies: - dependency-name: codeinwp/themeisle-sdk dependency-version: 3.3.57 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Soare-Robert-Daniel
added
the
pr-checklist-skip
Contributor
Co-authored-by: selul <3330746+selul@users.noreply.github.com>
Fix stale database data after saving charts
fix: check per-chart edit_post capability in chart_data REST field
…1314) Bumps [dealerdirect/phpcodesniffer-composer-installer](https://github.com/PHPCSStandards/composer-installer) from 1.2.0 to 1.2.1. - [Release notes](https://github.com/PHPCSStandards/composer-installer/releases) - [Changelog](https://github.com/PHPCSStandards/composer-installer/blob/main/CHANGELOG.md) - [Commits](PHPCSStandards/composer-installer@v1.2.0...v1.2.1) --- updated-dependencies: - dependency-name: dealerdirect/phpcodesniffer-composer-installer dependency-version: 1.2.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…o-gate fix: gate AI Builder db_query behind super-admin + Pro to match classic path
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The suite passed identically with can_edit_chart() reverted to current_user_can( 'edit_post' ): every case it exercised agreed under both checks. Add the two rows that differ — a contributor's own published chart (allowed only by the author branch) and a contributor's own non-chart post (allowed only by edit_post) — plus a workflow start/poll test that pins the transient binding, so a no-op set_transient() no longer passes. Start the e2e login contexts from an empty storage state. browser.newContext() inherits the project's admin cookies, so a login that silently failed left the requests running as admin; that also drops wordpress_test_cookie, hence no testcookie field. Delete the chart the contributor spec creates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix: enforce per-chart authorization in AI Builder endpoints
Contributor
|
🎉 This PR is included in version 4.0.7 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
pirate-bot
added
the
released
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked issues
This release will close the following issues once merged:
Public changelog