I'm saving sensitive data via JSON ajax request, it is not sanitized, literally anything can be passed.
I need to make sure that only admins with edit_options
permission can save it.
So I do:
function received_ajax_request() {
if ( !current_user_can('edit_options') ) {
return;
}
save_to_database( $_POST['something']) );
}
My question is how safe it is? Do I need to check for anything else besides current_user_can
?
For example, I saw some other plugins check also for nonce, but when rest API is used - nonces are generally not used.