Merge pull request #2394 from Codeinwp/vulnerability-237

Fixed vulnerability issue with author role
Codeinwp · Oct 7, 2024 · 9d5a78a · 9d5a78a
2 parents e6e9843 + e630d36
commit 9d5a78a
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/inc/css/class-css-handler.php b/inc/css/class-css-handler.php
@@ -142,8 +142,8 @@ public function register_routes() {
 							},
 						),
 					),
-					'permission_callback' => function () {
-						return current_user_can( 'publish_posts' );
+					'permission_callback' => function ( $request ) {
+						return current_user_can( 'edit_post', $request->get_param( 'id' ) );
 					},
 				),
 			)
@@ -166,8 +166,8 @@ public function register_routes() {
 							},
 						),
 					),
-					'permission_callback' => function () {
-						return current_user_can( 'publish_posts' );
+					'permission_callback' => function ( $request ) {
+						return current_user_can( 'edit_post', $request->get_param( 'id' ) );
 					},
 				),
 			)