Improve Permission Checks

[n7studios]

Summary

Adds object-level authorization checks for Kit admin actions that write data or create external resources.

• Restricts the Plugin Setup Wizard to users with manage_options.
• Requires users of the Landing Page and Member Content wizards to be able to create and publish the selected Post Type.
• Hides the Landing Page and Member Content buttons when the current user lacks those capabilities.
• Prevents Bulk Edit, post settings, category settings, pre-publish actions, and Broadcast export from acting on content the current user cannot edit.
• Restricts automatic third-party cache-plugin configuration to Administrators.

Some checks are additional e.g. current_user_can( 'edit_term', $term_id ) within save_category_fields, which WordPress will already run some security checks again.

Testing

Added integration coverage for:

• Post Type create/publish capability checks.
• Plugin Setup Wizard manage_options access requirement.
• Landing Page and Member Content button registration for unauthorized users.
• Unauthorized post and category settings saves.
• Unauthorized Broadcast export requests.

Added end-to-end coverage for:

• Hiding Landing Page and Member Content buttons for a user who can edit Pages but cannot publish them.
• Preventing a malicious Bulk Edit request from saving Kit metadata against another user’s Post.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground