Fix vulnerability issue with author role

Codeinwp · Oct 3, 2024 · e630d36 · e630d36
1 parent 116a035
commit e630d36
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/inc/css/class-css-handler.php b/inc/css/class-css-handler.php
@@ -142,8 +142,8 @@ public function register_routes() {
 							},
 						),
 					),
-					'permission_callback' => function () {
-						return current_user_can( 'publish_posts' );
+					'permission_callback' => function ( $request ) {
+						return current_user_can( 'edit_post', $request->get_param( 'id' ) );
 					},
 				),
 			)
@@ -166,8 +166,8 @@ public function register_routes() {
 							},
 						),
 					),
-					'permission_callback' => function () {
-						return current_user_can( 'publish_posts' );
+					'permission_callback' => function ( $request ) {
+						return current_user_can( 'edit_post', $request->get_param( 'id' ) );
 					},
 				),
 			)