Changeset 3377606

Timestamp:

10/13/2025 02:42:26 PM (2 months ago)

Author:

jetmonsters

Message:

Version: 2.4.8

Location:

mp-restaurant-menu/trunk

Files:

• classes/controllers/class-controller-customer.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• restaurant-menu.php (modified) (1 diff)
• templates-functions/restaurant-menu-shop-functions.php (modified) (1 diff)

mp-restaurant-menu/trunk/classes/controllers/class-controller-customer.php

@@ -125 +125 @@
     public function action_get_customer_information() {
 
-        $customer_object = NULL;
-
-        if ( isset( $_REQUEST['customer_id'] ) ) {
+        $this->date['success'] = false;
+
+        if ( is_admin() && current_user_can('manage_restaurant_menu') && isset( $_REQUEST['customer_id'] ) ) {
+
             $customer_object = $this->get('customer')->get_customer(
-                array('field' => 'id', 'value' => sanitize_text_field( wp_unslash( $_REQUEST['customer_id'] ) ))
+                array('field' => 'id', 'value' => sanitize_text_field( wp_unslash( $_REQUEST['customer_id'] ) ) )
             );
-        }
-
-        if (!empty($customer_object)) {
-            $this->date['success'] = true;
-            $this->date['data']['customer_information'] = View::get_instance()->render_html('../admin/metaboxes/order/customer-information', array('customer_id' => $customer_object->id), false);
-        } else {
-            $this->date['success'] = false;
+
+            if ( ! empty( $customer_object ) ) {
+
+                $this->date['success'] = true;
+                $this->date['data']['customer_information'] = View::get_instance()->render_html('../admin/metaboxes/order/customer-information', array('customer_id' => $customer_object->id), false);
+            }
         }
 

mp-restaurant-menu/trunk/readme.txt

@@ -4 +4 @@
 Tags: restaurant menu, food menu, restaurant, food delivery, cafe menu, food ordering system, online ordering, store, cafe, pizza, pizzeria, food, food order, delivery, toppings, sell, e-commerce, recipe, cooking, ingredients, recipes
 Requires at least: 4.6
-Tested up to: 6.7
-Stable tag: 2.4.7
+Tested up to: 6.8
+Stable tag: 2.4.8
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -87 +87 @@
 == Changelog ==
 
+= 2.4.8, Jun 24 2025 =
+* Security – improved permission checks for viewing customer data.
+
 = 2.4.7, Jun 24 2025 =
 * Security – improved export process validation.

mp-restaurant-menu/trunk/restaurant-menu.php

@@ -4 +4 @@
  * Plugin URI: https://motopress.com/products/restaurant-menu/
  * Description: This plugin gives you the power to effectively create, maintain and display online menus for almost any kind of restaurant, cafes and other typical food establishments.
- * Version: 2.4.7
+ * Version: 2.4.8
  * Author: MotoPress
  * Author URI: https://motopress.com

mp-restaurant-menu/trunk/templates-functions/restaurant-menu-shop-functions.php

@@ -984 +984 @@
     $data = wp_parse_args($data, $argc);
     
-    $customers = models\Customer::get_instance()->get_customers();
+    $customers = models\Customer::get_instance()->get_customers(
+        array(
+            'number' => null,
+            'fields' => array('id', 'name')
+        )
+    );
+
     if (!empty($customers)) {
         foreach ($customers as $customer) {