Changeset 3745452 for image-hub/trunk/inc/src/MediaModal.php

Timestamp:

10/14/2026 06:21:08 AM (3 days ago)

Author:

iulianp

Message:

release 1.3.0

File:

• image-hub/trunk/inc/src/MediaModal.php (modified) (3 diffs)

image-hub/trunk/inc/src/MediaModal.php

@@ -33 +33 @@
     public function image_hub_enqueue_media_library_scripts($id = '')
     {
-        if (is_admin()) {
+        if (is_admin() && current_user_can('upload_files')) {
             Utils::enque_image_hub_script('media-modal', false);
 
@@ -63 +63 @@
                 }
 
+                if (!current_user_can('upload_files')) {
+                        wp_send_json_error('You are not allowed to upload files.', 403);
+                }
+
         // call the callback url to notify provider that image is downloaded (unsplash terms)
         //https://help.unsplash.com/en/articles/2511258-guideline-triggering-a-download
@@ -68 +72 @@
             $callback_url = esc_url_raw(wp_unslash($_POST['downloadImageCallbackUrl']));
 
-            if (filter_var($callback_url, FILTER_VALIDATE_URL)) {
-                $response = wp_remote_get($callback_url);
+            // The callback always goes through the image service, so any other host is ignored.
+            $service_host = wp_parse_url(Utils::get_service_url(), PHP_URL_HOST);
+
+            if (filter_var($callback_url, FILTER_VALIDATE_URL) && $service_host && wp_parse_url($callback_url, PHP_URL_HOST) === $service_host) {
+                // A dev service can run on localhost, which wp_safe_remote_get() refuses.
+                $response = defined('IMAGE_HUB_DEV_SERVICE_URL') ? wp_remote_get($callback_url) : wp_safe_remote_get($callback_url);
                 if (is_wp_error($response)) {
                     wp_send_json_error('Failed to fetch data from callback URL. ' . $callback_url);