Skip to content

fix: enforce chart-level authorization on AJAX handlers (#594)#1342

Merged
Soare-Robert-Daniel merged 4 commits into
developmentfrom
fix/594-chart-authorization
Jul 15, 2026
Merged

fix: enforce chart-level authorization on AJAX handlers (#594)#1342
Soare-Robert-Daniel merged 4 commits into
developmentfrom
fix/594-chart-authorization

Conversation

@lucadobrescu

@lucadobrescu lucadobrescu commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • Add \Visualizer_Module::can_edit_chart()\ and use it across the remaining free AJAX handlers affected by Manual data tab to show options for multiple editors #594.
  • Require nonce plus capability for \getCharts, enforce per-chart checks on delete/clone/export/JSON/filter/edit flows, and scope library listings to editable charts.
  • Add regression tests covering unauthorized chart access, map API key updates, and export denial.

Related

Test plan

  • Run PHPUnit in CI for \ ests/test-ajax.php\ and \ ests/test-export.php\
  • Verify a contributor cannot delete, clone, export, or edit another user's chart
  • Verify \�isualizer-get-charts\ requires nonce + \edit_posts\ and only returns editable charts
  • Verify JSON schedule/data/filter handlers reject foreign chart IDs

@cursor-agent
fix: enforce chart-level authorization on AJAX handlers (#594)
2700582 
Add shared chart edit checks and regression tests so nonce validation no longer acts as authorization across chart read, write, clone, export, and schedule handlers.
@pirate-bot pirate-bot added the pr-checklist-incomplete The Pull Request checklist is incomplete. (automatic label) label Jul 15, 2026
@pirate-bot

pirate-bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Plugin build for a2fdf00 is ready 🛎️!

@cursor-agent
fix: use serialized chart fixtures in authorization tests (#594)
28c09dd 
Test charts now store PHP-serialized post_content so getCharts() can decode them after the #1339 unserialize hardening.
@cursor-agent
fix: catch wp_die stop exception in clone authorization test (#594)
dc9ee85 
cloneChart() calls wp_die() in the PHPUnit environment when the user cannot edit the source chart.
@lucadobrescu lucadobrescu self-assigned this Jul 15, 2026
@lucadobrescu lucadobrescu added pr-checklist-skip Allow this Pull Request to skip checklist. and removed pr-checklist-incomplete The Pull Request checklist is incomplete. (automatic label) labels Jul 15, 2026
@pirate-bot pirate-bot added the pr-checklist-complete The Pull Request checklist is complete. (automatic label) label Jul 15, 2026
@Soare-Robert-Daniel Soare-Robert-Daniel merged commit e42b4d7 into development Jul 15, 2026
10 checks passed
@Soare-Robert-Daniel Soare-Robert-Daniel deleted the fix/594-chart-authorization branch July 15, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Soare-Robert-Daniel Soare-Robert-Daniel Soare-Robert-Daniel approved these changes

Assignees

@lucadobrescu lucadobrescu

Labels

pr-checklist-complete The Pull Request checklist is complete. (automatic label) pr-checklist-skip Allow this Pull Request to skip checklist.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@lucadobrescu @pirate-bot @Soare-Robert-Daniel @cursor-agent