Merge pull request #1140 from cloudinary/improve/cloudinary-down-sync-hook

Improve down_sync_asset hook

Author: aatanasov-cloudinary

php/class-media.php

@@ -2285,8 +2285,7 @@ function ( $value, $key ) use ( &$asset ) {
 	 */
 	public function down_sync_asset() {
 		$nonce = Utils::get_sanitized_text( 'nonce', INPUT_POST );
-		if ( wp_verify_nonce( $nonce, 'wp_rest' ) ) {
-
+		if ( is_user_logged_in() && wp_verify_nonce( $nonce, 'wp_rest' ) && current_user_can( 'upload_files' ) ) {
 			$asset = $this->get_asset_payload();
 			// Set a base array for pulling an asset if needed.
 			$base_return = array(