diff --git a/php/admin/admin-results-details-page.php b/php/admin/admin-results-details-page.php index 25e11a90..f4ff9b53 100644 --- a/php/admin/admin-results-details-page.php +++ b/php/admin/admin-results-details-page.php @@ -69,8 +69,9 @@ function qsm_generate_results_details_tab() { $quiz_id = intval( $results_data->quiz_id ); $mlwQuizMasterNext->pluginHelper->prepare_quiz( $quiz_id ); - $quiz_post_id = $wpdb->get_var( "SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'quiz_id' AND meta_value = '$quiz_id'" ); - if ( empty( $quiz_post_id ) || ! current_user_can( 'edit_qsm_quiz', $quiz_post_id ) ) { + $quiz_post_id = $wpdb->get_var( $wpdb->prepare( "SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'quiz_id' AND meta_value = %d", $quiz_id ) ); + $post_author = get_post_field( 'post_author', $quiz_post_id ); + if ( ( current_user_can( 'view_qsm_quiz_result' ) && $post_author == get_current_user_id() ) || ! current_user_can( 'edit_others_qsm_quizzes' ) ) { return; } diff --git a/php/admin/quizzes-page.php b/php/admin/quizzes-page.php index db611d56..f587b69a 100644 --- a/php/admin/quizzes-page.php +++ b/php/admin/quizzes-page.php @@ -180,16 +180,16 @@ public function qsm_post_row_actions( $actions, $post ) { $quiz_id = get_post_meta( $post->ID, 'quiz_id', true ); if ( ! empty( $quiz_id ) ) { $actions = array(); - if ( current_user_can( 'edit_qsm_quiz', $post->ID ) ) { + if ( ( current_user_can( 'edit_qsm_quiz', $post->ID ) && $post->post_author == get_current_user_id() ) || current_user_can( 'edit_others_qsm_quizzes' ) ) { $actions['edit'] = '' . esc_html__( 'Edit', 'quiz-master-next' ) . ''; } - if ( current_user_can( 'duplicate_qsm_quiz', $post->ID ) ) { + if ( ( current_user_can( 'duplicate_qsm_quiz', $post->ID ) && $post->post_author == get_current_user_id() ) || current_user_can( 'edit_others_qsm_quizzes' ) ) { $actions['duplicate'] = '' . esc_html__( 'Duplicate', 'quiz-master-next' ) . ''; } - if ( current_user_can( 'delete_published_qsm_quizzes' ) ) { + if ( ( current_user_can( 'delete_qsm_quiz', $post->ID ) && $post->post_author == get_current_user_id() ) || current_user_can( 'delete_others_qsm_quizzes' ) ) { $actions['delete'] = '' . esc_html__( 'Delete', 'quiz-master-next' ) . ''; } - if ( current_user_can( 'view_qsm_quiz_result' ) ) { + if ( ( current_user_can( 'view_qsm_quiz_result' ) && $post->post_author == get_current_user_id() ) || current_user_can( 'edit_others_qsm_quizzes' ) ) { $actions['view_result'] = '' . esc_html__( 'View Results', 'quiz-master-next' ) . ''; } if ( empty( $settings['disable_quiz_public_link'] ) ) {