Conversation
Adds current_user_can( 'edit_theme_options' ) alongside the existing nonce verification in the demo-import migration trigger, its notice, and its dismiss handler. The nonce alone only proved the request came from the current user's own session, not that they were allowed to run the action - any logged-in user, regardless of role, could force a site-wide theme_mods and options rewrite using stale legacy data, since the migration functions are hooked to after_setup_theme, which fires on the front end too. Verified live: a subscriber-role account, using a nonce genuinely valid for their own session, is now correctly rejected with "You do not have permission to perform this action."
QA suite — refused, no regression specThis PR changes product source but adds no spec, so the suite was Source files changed with no matching spec |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Add the low-privilege regression test and regenerate the translation catalog.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Adds capability checks to prevent unauthorized users from triggering demo-import migrations or dismissing related notices.
Changes:
- Restricts migration actions to users with
edit_theme_options. - Returns a permission error for unauthorized requests.
- Adds a translatable permission message.
| File | Summary |
|---|---|
inc/demo-import-migration.php |
Adds capability checks to migration-related flows. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+89
to
+91
| if ( ! current_user_can( 'edit_theme_options' ) ) { | ||
| wp_die( __( 'You do not have permission to perform this action.', 'spacious' ) ); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes proposed in this Pull Request:
Fixes themegrill/spacious-pro#75 (filed against the Pro repo since this same file is shared byte-for-byte between both themes). A migration feature meant for admins had a nonce check but no permission check. This meant any logged-in user, even the lowest-privilege account on the site (for example, a regular customer account on a shop), could trigger a full theme settings reset by visiting a specific link - and this worked on any page of the site, not just admin pages. This fix adds the missing permission check, so only users who are allowed to change theme settings can trigger this.
How to test the changes in this Pull Request:
Types of changes:
Other information:
Changelog entry
Fix - Missing capability check on demo-import migration trigger.