Skip to content

fix: scheduled CSV refresh runs without a logged-in user #1333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Alexia-Soare wants to merge 1 commit into
base: development
Choose a base branch
from
+49 −3
Open

fix: scheduled CSV refresh runs without a logged-in user #1333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions classes/Visualizer/Module/Chart.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1222,12 +1222,13 @@ public function uploadData() {
// if this is being called internally from pro and VISUALIZER_DO_NOT_DIE is set.
// otherwise, assume this is a normal web request.
$can_die = ! ( defined( 'VISUALIZER_DO_NOT_DIE' ) && VISUALIZER_DO_NOT_DIE );
// $can_die also gates the capability checks below, so VISUALIZER_DO_NOT_DIE must stay internal-only (never set from request input or globally).

// validate nonce
// validate nonce; capability check applies to web requests only, not trusted internal calls.
if (
! isset( $_GET['nonce'] ) ||
! wp_verify_nonce( $_GET['nonce'], 'visualizer-upload-data' ) ||
! current_user_can( 'edit_posts' )
( $can_die && ! current_user_can( 'edit_posts' ) )
) {
if ( ! $can_die ) {
return;
Expand All @@ -1244,7 +1245,7 @@ public function uploadData() {
! $chart_id ||
! $chart ||
$chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ||
! current_user_can( 'edit_post', $chart_id )
( $can_die && ! current_user_can( 'edit_post', $chart_id ) )
) {
if ( ! $can_die ) {
return;
Expand Down
45 changes: 45 additions & 0 deletions tests/test-schedule.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
<?php
/**
* Tests for background/scheduled import behavior.
*
* @package visualizer
* @subpackage Tests
* @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
*/

/**
* Scheduled/background refresh must still import with no logged-in user (regression for visualizer-pro#590).
*
* ponytail: defines VISUALIZER_DO_NOT_DIE process-wide; isolate this test if one ever needs the exit/die path.
*/
class Test_Visualizer_Schedule extends WP_UnitTestCase {

/**
* Internal upload (no user, VISUALIZER_DO_NOT_DIE set) must still import and persist chart data.
*/
public function test_internal_upload_imports_without_logged_in_user() {
wp_set_current_user( 0 );
$this->assertFalse( current_user_can( 'edit_posts' ), 'precondition: background context has no editing user' );

$chart_id = self::factory()->post->create(
array(
'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
'post_status' => 'publish',
'post_content' => 'OLD-CONTENT',
)
);

// mimic Pro's internal invocation; clean superglobals so prior tests don't reroute uploadData().
$_GET = $_POST = $_FILES = array();
define( 'VISUALIZER_DO_NOT_DIE', true );
$_GET['nonce'] = wp_create_nonce( 'visualizer-upload-data' );
$_GET['chart'] = $chart_id;
$_POST['editor-type'] = 'text';
$_POST['chart_data'] = "Name,Value\nstring,number\nAlpha,111\nBeta,222";

do_action( 'wp_ajax_' . Visualizer_Plugin::ACTION_UPLOAD_DATA );

$content = get_post_field( 'post_content', $chart_id );
$this->assertStringContainsString( 'Alpha', $content, 'scheduled/background import must update chart data without a logged-in user' );
}
}
Loading