diff --git a/admin/woocommerce-admin-functions.php b/admin/woocommerce-admin-functions.php index 930311e536b..951812aa1b8 100644 --- a/admin/woocommerce-admin-functions.php +++ b/admin/woocommerce-admin-functions.php @@ -191,7 +191,7 @@ function woocommerce_preview_emails() { * @return void */ function woocommerce_prevent_admin_access() { - if ( get_option('woocommerce_lock_down_admin') == 'yes' && ! is_ajax() && ! current_user_can('edit_posts') ) { + if ( get_option('woocommerce_lock_down_admin') == 'yes' && ! is_ajax() && ! ( current_user_can('edit_posts') || current_user_can('manage_woocommerce') ) ) { wp_safe_redirect(get_permalink(woocommerce_get_page_id('myaccount'))); exit; } diff --git a/woocommerce-ajax.php b/woocommerce-ajax.php index 6a83815771f..2dad72b668a 100644 --- a/woocommerce-ajax.php +++ b/woocommerce-ajax.php @@ -267,7 +267,7 @@ function woocommerce_feature_product() { if ( ! is_admin() ) die; - if ( ! current_user_can('edit_posts') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); + if ( ! current_user_can('edit_products') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); if ( ! check_admin_referer('woocommerce-feature-product')) wp_die( __( 'You have taken too long. Please go back and retry.', 'woocommerce' ) ); @@ -301,7 +301,7 @@ add_action('wp_ajax_woocommerce-feature-product', 'woocommerce_feature_product') function woocommerce_mark_order_complete() { if ( !is_admin() ) die; - if ( !current_user_can('edit_posts') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); + if ( !current_user_can('edit_shop_orders') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); if ( !check_admin_referer('woocommerce-mark-order-complete')) wp_die( __( 'You have taken too long. Please go back and retry.', 'woocommerce' ) ); $order_id = isset($_GET['order_id']) && (int) $_GET['order_id'] ? (int) $_GET['order_id'] : ''; if (!$order_id) die; @@ -324,7 +324,7 @@ add_action('wp_ajax_woocommerce-mark-order-complete', 'woocommerce_mark_order_co function woocommerce_mark_order_processing() { if ( !is_admin() ) die; - if ( !current_user_can('edit_posts') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); + if ( !current_user_can('edit_shop_orders') ) wp_die( __( 'You do not have sufficient permissions to access this page.', 'woocommerce' ) ); if ( !check_admin_referer('woocommerce-mark-order-processing')) wp_die( __( 'You have taken too long. Please go back and retry.', 'woocommerce' ) ); $order_id = isset($_GET['order_id']) && (int) $_GET['order_id'] ? (int) $_GET['order_id'] : ''; if (!$order_id) die; @@ -1328,7 +1328,7 @@ function woocommerce_product_ordering() { global $wpdb; // check permissions again and make sure we have what we need - if ( ! current_user_can('edit_others_pages') || empty( $_POST['id'] ) || ( ! isset( $_POST['previd'] ) && ! isset( $_POST['nextid'] ) ) ) + if ( ! current_user_can('edit_products') || empty( $_POST['id'] ) || ( ! isset( $_POST['previd'] ) && ! isset( $_POST['nextid'] ) ) ) die(-1); // real post? diff --git a/woocommerce-core-functions.php b/woocommerce-core-functions.php index 172d276b753..554ce37be3a 100644 --- a/woocommerce-core-functions.php +++ b/woocommerce-core-functions.php @@ -197,7 +197,7 @@ if ( ! function_exists( 'woocommerce_disable_admin_bar' ) ) { * @return bool */ function woocommerce_disable_admin_bar( $show_admin_bar ) { - if ( get_option('woocommerce_lock_down_admin')=='yes' && ! current_user_can('edit_posts') ) { + if ( get_option('woocommerce_lock_down_admin')=='yes' && ! ( current_user_can('edit_posts') || current_user_can('manage_woocommerce') ) ) { $show_admin_bar = false; }