fix: scheduled CSV refresh runs without a logged-in user#1333
Open
Alexia-Soare wants to merge 1 commit into
Open
fix: scheduled CSV refresh runs without a logged-in user#1333Alexia-Soare wants to merge 1 commit into
Alexia-Soare wants to merge 1 commit into
Conversation
Background schedule/refresh invokes the upload handler with no logged-in
user and VISUALIZER_DO_NOT_DIE set. Since Feb 2026 uploadData() also
requires edit_posts/edit_post, so the scheduled import silently returned
and charts stopped auto-updating.
Gate the two capability checks on $can_die so they apply to real web
requests only; trusted internal calls (the only context that defines
VISUALIZER_DO_NOT_DIE, never from request input) proceed. Web path and
the nonce check are unchanged.
Fixes Codeinwp/visualizer-pro#590
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Alexia-Soare
added
the
pr-checklist-skip
pirate-bot
added
the
pr-checklist-complete
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the scheduled remote-CSV auto-sync silently stopping. Related issue: https://github.com/Codeinwp/visualizer-pro/issues/590
Problem
Background schedule/refresh calls
uploadData()with no logged-in user andVISUALIZER_DO_NOT_DIEset. Since Feb 2026 that handler also requiresedit_posts/edit_post, so with no user the check fails and the internal callreturns silently — the chart never refreshes while Pro advances the next-run time anyway.Fix
Gate the two capability checks on
$can_dieso they apply to real web requests only. Trusted internal calls (the sole context that definesVISUALIZER_DO_NOT_DIE, never from request input) proceed and import.Safety
$can_dieis true the expressions are identical to before, so all existing checks (incl. the nonce) stay enforced.VISUALIZER_DO_NOT_DIEis defined only in internal scheduled handlers, never from request data, so the relaxation can't be reached by an attacker.Tests
tests/test-schedule.php— asserts a no-user internal import updates the chart; green with the fix, red without. Full suite passes (the only errors are a pre-existingtsdk_utmify()gap inTest_Revisions, unrelated).