From 42ca09e6c7a510f8ebf7544f71c95f7747243607 Mon Sep 17 00:00:00 2001 From: Kelly Dwan Date: Tue, 26 Nov 2019 09:56:12 -0500 Subject: [PATCH] Only enqueue script if the user is authorized --- plugins/wporg-5ftf/includes/pledge-meta.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/plugins/wporg-5ftf/includes/pledge-meta.php b/plugins/wporg-5ftf/includes/pledge-meta.php index 350849f..c3a02f3 100755 --- a/plugins/wporg-5ftf/includes/pledge-meta.php +++ b/plugins/wporg-5ftf/includes/pledge-meta.php @@ -6,7 +6,7 @@ namespace WordPressDotOrg\FiveForTheFuture\PledgeMeta; use WordPressDotOrg\FiveForTheFuture; -use WordPressDotOrg\FiveForTheFuture\{ Contributor, Email, Pledge, PledgeForm, XProfile }; +use WordPressDotOrg\FiveForTheFuture\{ Auth, Contributor, Email, Pledge, PledgeForm, XProfile }; use WP_Post, WP_Error; defined( 'WPINC' ) || die(); @@ -531,8 +531,13 @@ function enqueue_assets() { } } else { global $post; - if ( $post instanceof WP_Post && has_shortcode( $post->post_content, '5ftf_pledge_form_manage' ) ) { - wp_enqueue_script( '5ftf-admin' ); + if ( is_a( $post, 'WP_Post' ) ) { + $pledge_id = absint( $_REQUEST['pledge_id'] ?? 0 ); + $auth_token = sanitize_text_field( $_REQUEST['auth_token'] ?? '' ); + $can_manage = Auth\can_manage_pledge( $pledge_id, $auth_token ); + if ( ! is_wp_error( $can_manage ) && has_shortcode( $post->post_content, '5ftf_pledge_form_manage' ) ) { + wp_enqueue_script( '5ftf-admin' ); + } } } }