From 0539fbd2325708a224f49444e1f1ff872fdbac94 Mon Sep 17 00:00:00 2001 From: Ashley Gibson Date: Wed, 19 Aug 2026 12:50:38 +0100 Subject: [PATCH 1/3] Only load admin token editor JS on profile.php and user-edit.php pages --- woocommerce/changelog.txt | 1 + ...ass-sv-wc-payment-gateway-admin-payment-token-editor.php | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/woocommerce/changelog.txt b/woocommerce/changelog.txt index 85a888e6c..da88d6609 100644 --- a/woocommerce/changelog.txt +++ b/woocommerce/changelog.txt @@ -1,6 +1,7 @@ *** SkyVerge WooCommerce Plugin Framework Changelog *** 2026.nn.nn - version 6.2.4 +* Tweak - Only load admin token editor JS on profile.php and user-edit.php pages 2026.06.23 - version 6.2.3 * Fix - Address "wp_script_is was called incorrectly" errors when instantiating the `SV_WP_Job_Batch_Handler` class diff --git a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php index c0b2d08e0..25fce9e9c 100644 --- a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php +++ b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php @@ -79,6 +79,12 @@ public function __construct( SV_WC_Payment_Gateway_Direct $gateway ) { */ public function enqueue_scripts_styles() { + global $pagenow; + + if ( ! in_array( $pagenow, [ 'profile.php', 'user-edit.php' ], true ) ) { + return; + } + $gateway = $this->get_gateway(); $version = $gateway->get_plugin()->get_assets_version( $gateway->get_id() ); From 4dcd79da7c2cea1e196169403335dac72df73c9a Mon Sep 17 00:00:00 2001 From: Ashley Gibson Date: Wed, 19 Aug 2026 13:00:08 +0100 Subject: [PATCH 2/3] Add capability check --- ...class-sv-wc-payment-gateway-admin-payment-token-editor.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php index 25fce9e9c..3ab74447b 100644 --- a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php +++ b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php @@ -85,6 +85,10 @@ public function enqueue_scripts_styles() { return; } + if ( ! current_user_can( 'manage_woocommerce' ) ) { + return; + } + $gateway = $this->get_gateway(); $version = $gateway->get_plugin()->get_assets_version( $gateway->get_id() ); From d4b7205d2f029cd5fff2720a3f150e29bb700360 Mon Sep 17 00:00:00 2001 From: Ashley Gibson Date: Wed, 19 Aug 2026 13:11:06 +0100 Subject: [PATCH 3/3] Capability checks --- woocommerce/changelog.txt | 1 + ...wc-payment-gateway-admin-payment-token-editor.php | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/woocommerce/changelog.txt b/woocommerce/changelog.txt index da88d6609..1f3be13dc 100644 --- a/woocommerce/changelog.txt +++ b/woocommerce/changelog.txt @@ -1,6 +1,7 @@ *** SkyVerge WooCommerce Plugin Framework Changelog *** 2026.nn.nn - version 6.2.4 +* Security - Hardened capability checks around the payment token editor's admin functionality * Tweak - Only load admin token editor JS on profile.php and user-edit.php pages 2026.06.23 - version 6.2.3 diff --git a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php index 3ab74447b..42aec9df4 100644 --- a/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php +++ b/woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php @@ -222,6 +222,10 @@ public function ajax_get_blank_token() { check_ajax_referer( 'wc_payment_gateway_admin_get_blank_payment_token', 'security' ); + if ( ! current_user_can( 'manage_woocommerce' ) ) { + wp_send_json_error(); + } + $index = SV_WC_Helper::get_requested_value( 'index' ); if ( $index ) { @@ -265,6 +269,10 @@ public function ajax_remove_token() { throw new SV_WC_Payment_Gateway_Exception( 'Invalid nonce' ); } + if ( ! current_user_can( 'manage_woocommerce' ) ) { + throw new SV_WC_Payment_Gateway_Exception( 'You do not have permission to perform this action' ); + } + $user_id = SV_WC_Helper::get_requested_value( 'user_id' ); $token_id = SV_WC_Helper::get_requested_value( 'token_id' ); @@ -302,6 +310,10 @@ public function ajax_refresh_tokens() { throw new SV_WC_Payment_Gateway_Exception( 'Invalid nonce' ); } + if ( ! current_user_can( 'manage_woocommerce' ) ) { + throw new SV_WC_Payment_Gateway_Exception( 'You do not have permission to perform this action' ); + } + $user_id = SV_WC_Helper::get_requested_value( 'user_id' ); if ( ! $user_id ) {