积分与余额账务系统硬切重构

src/Admin/ControllerBase.php

@@ -23,8 +23,20 @@ abstract class ControllerBase {
     /**
      * Permission callback — requires manage_options capability.
      */
-    public function check_permission(): bool {
-        return current_user_can('manage_options');
+	public function check_permission(?\WP_REST_Request $request = null) {
+		if (!current_user_can('manage_options')) {
+			if ($request === null) {
+				return false;
+			}
+			return new \WP_Error('aksrt_admin_forbidden', __('无权执行此操作', 'aksrt'), ['status' => 403]);
+		}
+		if ($request !== null) {
+			$nonce = (string) $request->get_header('X-WP-Nonce');
+			if ($nonce === '' || !wp_verify_nonce($nonce, 'wp_rest')) {
+				return new \WP_Error('aksrt_rest_nonce', __('安全验证失败，请刷新页面后重试', 'aksrt'), ['status' => 403]);
+			}
+		}
+		return true;
     }
 
     /**