Changeset 3751971 for mxchat-basic/trunk/admin/class-ajax-handler.php

Timestamp:

10/17/2026 01:47:11 PM (12 days ago)

Author:

mxchat

Message:

Release 3.2.26 - security hardening, new models (GPT-6.1 Sol, Claude 5.5 family, Grok 4.7, Gemini 4 Argon, DeepSeek Flash), automatic moves off discontinued models, token usage in Transcripts, page-builder and ACF Blocks imports

File:

• mxchat-basic/trunk/admin/class-ajax-handler.php (modified) (1 diff)

mxchat-basic/trunk/admin/class-ajax-handler.php

@@ -360 +360 @@
     check_ajax_referer('mxchat_save_setting_nonce');
     if (!current_user_can('manage_options')) {
-        ('MXChat Save: Unauthorized access attempt');
-        wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
+        // 403, like the nonce failure above: the read-only transcripts role
+        // (plan 93999a) must not save the Transcripts notification or
+        // retention settings that post here.
+        wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')], 403);
     }