Steve-Dee-Designs
/
woocommerce
mirror of https://github.com/woocommerce/woocommerce.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8323 from justinshreve/json-search-permissions-check-8321 

[2.3] Switch the ajax json_search_* functions to check for the read_product capability
This commit is contained in:
Mike Jolley 2015-06-09 14:06:03 +01:00
parent eb4b9a7cd1 a7891750b7
commit 4df7083dac
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
includes/class-wc-ajax.php
View File

@ -1711,10 +1711,6 @@ class WC_AJAX {
check_ajax_referer( 'search-products', 'security' );
if ( ! current_user_can( 'edit_products' ) ) {
die(-1);
}
$term = (string) wc_clean( stripslashes( $_GET['term'] ) );
if ( empty( $term ) ) {
@ -1789,6 +1785,10 @@ class WC_AJAX {
foreach ( $posts as $post ) {
$product = wc_get_product( $post );
if ( ! current_user_can( 'read_product', $post ) ) {
continue;
}
$found_products[ $post ] = rawurldecode( $product->get_formatted_name() );
}
}
@ -1863,10 +1863,6 @@ class WC_AJAX {
check_ajax_referer( 'search-products', 'security' );
if ( ! current_user_can( 'edit_products' ) ) {
die(-1);
}
$term = (string) wc_clean( stripslashes( $_GET['term'] ) );
$args = array(
@ -1890,6 +1886,11 @@ class WC_AJAX {
if ( ! empty( $posts ) ) {
foreach ( $posts as $post ) {
$product = wc_get_product( $post->ID );
if ( ! current_user_can( 'read_product', $post->ID ) ) {
continue;
}
$found_products[ $post->ID ] = $product->get_formatted_name();
}
}