AJAX call to admin-ajax.php by subscriber returns home page

Question

I am doing call to admin-ajax.php to change status of the post (CPT advert) (draft/publish) posts on the front end in a custom set up. This works fine for admin user. However when doing the same action with subscriber and console.log the response I get whole content of home page returned (not even error).

Here is my code to call ajaxurl var:

// AJAXURL VAR
add_action('wp_head', 'aii_ajaxurl');
add_action('admin_head', 'aii_ajaxurl');
function aii_ajaxurl() {
    echo '<script type="text/javascript">
          var ajaxurl = "' . admin_url('admin-ajax.php') . '";
          var nonce = "' . wp_create_nonce( 'aii_nonce' ) . '";
          </script>';
}

Here is my code to process the ajax call:

// AJAX MYACCOUNT CHANGE STATUS
add_action('wp_ajax_aii_ajax_status_advert',        
'aii_ajax_status_advert');
add_action('wp_ajax_nopriv_aii_ajax_status_advert', 
'aii_ajax_status_advert');
function aii_ajax_status_advert() {
  $result = '';
  global $current_user;
  wp_get_current_user();
  $permission = check_ajax_referer( 'aii_nonce', 'nonce', false );

   if( $permission != false ) {

   if ( is_user_logged_in() ) {


  $advert_id_sanitized = sanitize_text_field($_POST['id']);

  if(is_numeric($advert_id_sanitized)){

  $advert_id_clean = $advert_id_sanitized;
  $post_author_id = get_post_field( 'post_author', $advert_id_clean );
  if($current_user->ID == $post_author_id){
    $advert_status = sanitize_text_field($_POST['status']);
    if($advert_status == 'draft'){
      $advert_status_clean = 'publish';
    }
    if($advert_status == 'publish') {
      $advert_status_clean = 'draft';
    }

    $result = wp_update_post( array(
      'ID'    =>  $advert_id_clean,
      'post_status'   =>  $advert_status_clean
    ));

    $result = 'success';//var_dump($_POST);
  }
}

}
} else {
$result = 'error';
}
echo $result;
die();
}

Lastly this is my jQuery AJAX call:

    jQuery('.aii-table-col.change-status a').on('click', function(e) {
      e.preventDefault();



      changeNumber = jQuery(this).attr('href');
      changeNumber = changeNumber.slice(1);
      changeNonce = jQuery(this).data('nonce');
      changeStatus = jQuery(this).data('status');
      changeThis = jQuery(this);


      jQuery.ajax({
          type: 'post',
          url: ajaxurl,
          data: {
              action: 'aii_ajax_status_advert',
              nonce: changeNonce,
              id: changeNumber,
              status: changeStatus
          },
          success: function( result ) {
              console.log(result);
              if( result == 'success' ) {
                if(changeStatus=='draft'){
                  console.log('live now');

                  changeThis.find('i').removeClass('fa-play-circle-o');
                  changeThis.find('i').addClass('fa-pause-circle-o');
                  changeThis.data('status','publish');
                  changeThis.parent().parent().find('.status').empty().text('LIVE');
                  jQuery('.aii-toast').empty().append('<i class="fa fa-info-circle" aria-hidden="true"></i> Advert is now live').fadeIn(250);
                  setTimeout(function() {
                      jQuery(".aii-toast").fadeOut(500)
                  }, 3000);
                }
                if(changeStatus=='publish'){
                  console.log('pause now');

                  changeThis.find('i').removeClass('fa-pause-circle-o');
                  changeThis.find('i').addClass('fa-play-circle-o');
                  changeThis.data('status','draft');
                  changeThis.parent().parent().find('.status').empty().text('PAUSED');
                  jQuery('.aii-toast').empty().append('<i class="fa fa-info-circle" aria-hidden="true"></i> Advert is now paused').fadeIn(250);
                  setTimeout(function() {
                      jQuery(".aii-toast").fadeOut(500)
                  }, 3000);
                }
              }
          }

      })

    });

I have added the wp_ajax_nopriv action, even thou this subscriber must be loged in to be able to draft post (advert CPT) so according to this: https://codex.wordpress.org/Plugin_API/Action_Reference/wp_ajax_nopriv_(action) it is not even needed. Guys, what ma I missing? Why is this working fine for admin but subscriber is strangely returning (when console.log the data whole content of HOME PAGE).

Answer 1

I have also faced same issue,

after checking my functions.php codes,I found following code.

add_action('init', 'blockusers_init');

function blockusers_init() {
  if (is_admin() && !current_user_can('administrator')) {
    wp_redirect(home_url());
    exit;
  }
}

This code redirects the ajax call to home page.

To resolve this, add DOING_AJAX condition,

add_action('init', 'blockusers_init');

function blockusers_init() {
  if (is_admin() && !current_user_can('administrator') && !defined('DOING_AJAX')) {
    wp_redirect(home_url());
    exit;
  }
}

Hope this will helps you.