Skip to content

Reports: Align the meetup details export guard with sibling reports - #1834

Merged
obenland merged 1 commit into
productionfrom
fix/reports-export-capability-guard
Jul 30, 2026
Merged

Reports: Align the meetup details export guard with sibling reports#1834
obenland merged 1 commit into
productionfrom
fix/reports-export-capability-guard

Conversation

@obenland

Copy link
Copy Markdown
Member

Meetup_Details::export_to_file() combined its nonce and capability checks with &&, so the early-return guard did not require both conditions to hold. Every other report class in the plugin writes this guard so that both a valid run-report nonce and the view_wordcamp_reports capability are required — see class-meetup-events.php, class-meetup-sponsors.php, and class-wordcamp-details.php. This makes Meetup_Details consistent with them.

-		if ( ! wp_verify_nonce( $nonce, 'run-report' ) && current_user_can( CAPABILITY ) ) {
+		if ( ! wp_verify_nonce( $nonce, 'run-report' ) || ! current_user_can( CAPABILITY ) ) {
 			return;
 		}

How to test the changes in this Pull Request:

  1. As a user with the view_wordcamp_reports capability, open the Meetup Details report and export the CSV — it downloads as before.
  2. Confirm the guard now matches the sibling report classes (both a valid nonce and the capability are required to proceed).

🤖 Generated with Claude Code

`Meetup_Details::export_to_file()` joined its nonce and capability checks with
`&&`, so the two conditions were not both required. The other report classes
use `||`; this matches them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 30, 2026 13:48

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@obenland
obenland merged commit 295e4a3 into production Jul 30, 2026
5 checks passed
@obenland
obenland deleted the fix/reports-export-capability-guard branch July 30, 2026 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants