This should be moved just before the permissions check. Also, `$post` instead of `$product`.