Restore initial customize check

xwp · Jun 9, 2016 · ab6ca42 · ab6ca42
1 parent 7b5152c
commit ab6ca42
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/php/class-customize-snapshot-manager.php b/php/class-customize-snapshot-manager.php
@@ -521,6 +521,9 @@ public function update_snapshot() {
 		if ( ! check_ajax_referer( self::AJAX_ACTION, 'nonce', false ) ) {
 			status_header( 400 );
 			wp_send_json_error( 'bad_nonce' );
+		} elseif ( ! current_user_can( 'customize' ) ) {
+			status_header( 403 );
+			wp_send_json_error( 'customize_not_allowed' );
 		} elseif ( ! isset( $_SERVER['REQUEST_METHOD'] ) || 'POST' !== $_SERVER['REQUEST_METHOD'] ) { // WPCS: input var ok.
 			status_header( 405 );
 			wp_send_json_error( 'bad_method' );