Development

.gitignore

@@ -10,3 +10,6 @@ artifacts
 classes/Visualizer/Gutenberg/build
 classes/Visualizer/ChartBuilder/build
 classes/Visualizer/D3Renderer/build
+
+# Local wp-env port pinning (per-checkout).
+.wp-env.override.json

.wp-env.json

@@ -6,7 +6,7 @@
   ],
   "themes": [],
   "mappings": {
-    "wp-content/mu-plugins/visualizer-e2e-force-lazy-render.php": "./tests/e2e/config/force-lazy-render.php"
+    "wp-content/mu-plugins": "./tests/e2e/config/mu-plugins"
   },
   "config": {
     "WP_DEBUG": true,

classes/Visualizer/Gutenberg/Block.php

@@ -276,7 +276,7 @@ public function register_rest_endpoints() {
 	 * Get Post Meta Fields
 	 */
 	public function get_visualizer_data( $post ) {
-		if ( ! current_user_can( 'edit_posts' ) ) {
+		if ( ! Visualizer_Module::can_edit_chart( $post['id'] ) ) {
 			return false;
 		}
 

classes/Visualizer/Module.php

@@ -650,7 +650,7 @@ protected function get_inline_custom_css( $id, $settings ) {
 				$class_name = $id . $name;
 				$properties = implode( ' !important; ', array_filter( $attributes ) );
 				if ( ! empty( $properties ) ) {
-					$css    .= '.' . $class_name . ' {' . $properties . ' !important;}';
+					$css    .= wp_strip_all_tags( '.' . $class_name . ' {' . $properties . ' !important;}' );
 					$classes[ $name ] = $class_name;
 				}
 			}

classes/Visualizer/Module/AIBuilder.php

@@ -100,7 +100,7 @@ private function _verify_create_nonce(): void {
 	 * @param int $chart_id Chart ID.
 	 */
 	private function _verify_chart_access( $chart_id ): void {
-		if ( ! current_user_can( 'edit_post', $chart_id ) ) {
+		if ( ! self::can_edit_chart( $chart_id ) ) {
 			wp_send_json_error( array( 'message' => __( 'Unauthorized.', 'visualizer' ) ), 403 );
 		}
 	}
@@ -369,7 +369,7 @@ public function uploadData(): void {
 
 			// ── Database query ────────────────────────────────────────────────
 			case 'db_query':
-				if ( ! current_user_can( 'manage_options' ) && ! is_super_admin() ) {
+				if ( ! current_user_can( 'manage_options' ) || ! is_super_admin() || ! Visualizer_Module::is_pro() ) {
 					wp_send_json_error( array( 'message' => __( 'Action not allowed for this user.', 'visualizer' ) ), 403 );
 				}
 				if ( empty( $_POST['db_query'] ) ) {
@@ -502,6 +502,10 @@ public function generateChart(): void {
 			}
 		}
 
+		if ( ! empty( $workflow_id ) ) {
+			set_transient( 'viz_ai_wf_' . $workflow_id, get_current_user_id(), 6 * HOUR_IN_SECONDS );
+		}
+
 		wp_send_json_success(
 			array(
 				'workflow_id' => $workflow_id,
@@ -524,6 +528,10 @@ public function chartStatus(): void {
 			wp_send_json_error( array( 'message' => __( 'Missing workflow ID.', 'visualizer' ) ) );
 		}
 
+		if ( (int) get_transient( 'viz_ai_wf_' . $workflow_id ) !== get_current_user_id() ) {
+			wp_send_json_error( array( 'message' => __( 'Unauthorized.', 'visualizer' ) ), 403 );
+		}
+
 		$agents_url    = VISUALIZER_AGENTS_URL;
 		$workflow_slug = $this->_get_workflow_slug();
 		$headers       = $this->_get_agents_headers();

classes/Visualizer/Module/Wizard.php

@@ -153,6 +153,12 @@ public function visualizer_enqueue_setup_wizard_scripts() {
 	 * @return bool|void
 	 */
 	public function dismissWizard( $redirect_to_dashboard = true ) {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_die( esc_html__( 'You do not have permission to perform this action.', 'visualizer' ), '', array( 'response' => 403 ) );
+		}
+		if ( false !== $redirect_to_dashboard ) {
+			check_admin_referer( 'visualizer_dismiss_wizard' );
+		}
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$status = isset( $_REQUEST['status'] ) ? (int) $_REQUEST['status'] : 0;
 		update_option( 'visualizer_fresh_install', $status );
@@ -169,6 +175,9 @@ public function dismissWizard( $redirect_to_dashboard = true ) {
 	 */
 	public function visualizer_wizard_step_process() {
 		check_ajax_referer( VISUALIZER_ABSPATH, 'security' );
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json( array( 'status' => 0 ), 403 );
+		}
 		$step = ! empty( $_POST['step'] ) ? sanitize_text_field( wp_unslash( $_POST['step'] ) ) : 1;
 		switch ( $step ) {
 			case 'step_2':

js/frame.js

@@ -479,6 +479,34 @@
 
         init_db_import_component();
 
+        var settings_button = document.querySelector( '#settings-button' );
+        if ( settings_button ) {
+            settings_button.addEventListener( 'click', function( event ){
+                $('body').trigger('visualizer:db:query:update', {});
+                if( $( '#db-chart-button' ).attr( 'data-current' ) !== 'filter' || $( '.visualizer-db-query' ).val().length === 0 ){
+                    return;
+                }
+
+                event.preventDefault();
+                event.stopImmediatePropagation();
+
+                var query_saved = false;
+                var resume_save = function(){
+                    query_saved = true;
+                    settings_button.click();
+                };
+
+                $('body').one( 'visualizer:render:currentchart:update', resume_save );
+                $( '#thehole' ).one( 'load', function(){
+                    $('body').off( 'visualizer:render:currentchart:update', resume_save );
+                    if ( ! query_saved ) {
+                        $( '#db-chart-button' ).trigger( 'click' );
+                    }
+                } );
+                $( '#db-chart-button' ).trigger( 'click' );
+            }, true );
+        }
+
         $('#visualizer-query-fetch').on('click', function(e){
 
             $('body').trigger('visualizer:db:query:update', {});

templates/setup-wizard.php

@@ -6,12 +6,15 @@
  * @package Templates
  */
 
-$dashboard_url = add_query_arg(
-	array(
-		'action' => 'visualizer_dismiss_wizard',
-		'status' => 0,
+$dashboard_url = wp_nonce_url(
+	add_query_arg(
+		array(
+			'action' => 'visualizer_dismiss_wizard',
+			'status' => 0,
+		),
+		admin_url( 'admin.php' )
 	),
-	admin_url( 'admin.php' )
+	'visualizer_dismiss_wizard'
 );
 
 $chart_id           = ! empty( $this->wizard_data['chart_id'] ) ? (int) $this->wizard_data['chart_id'] : '';

tests/e2e/config/mu-plugins/enable-database-source.php

@@ -0,0 +1,26 @@
+<?php
+/**
+ * Enable database-source E2E tests for requests carrying the test cookie.
+ */
+
+if ( defined( 'TI_E2E_TESTING' ) && isset( $_COOKIE['visualizer_e2e_database_source'] ) ) {
+	defined( 'VISUALIZER_PRO_VERSION' ) || define( 'VISUALIZER_PRO_VERSION', '2.0.1' );
+
+	if ( ! class_exists( 'Visualizer_Pro' ) ) {
+		class Visualizer_Pro {
+			const ACTION_FETCH_DATA = 'visualizer-fetch-data';
+			const CF_PERMISSIONS    = 'visualizer-permissions';
+		}
+	}
+
+	add_filter( 'visualizer_is_pro', '__return_true', PHP_INT_MAX );
+
+	add_filter(
+		'visualizer_pro_upsell_class',
+		function ( $class, $feature = '' ) {
+			return 'db-query' === $feature ? '' : $class;
+		},
+		PHP_INT_MAX,
+		2
+	);
+}