Ticket #13917: 13917-refresh.2.diff

wp-includes/class-wp-xmlrpc-server.php

@@ -4894 +4894 @@
                         return new IXR_Error(500, $errorString);
                 }
                 // Construct the attachment array
-                // attach to post_id 0
                 $post_id = 0;
+                if ( ! empty( $data['post_id'] ) ) {
+                        $post_id = (int) $data['post_id'];
+
+                        if ( ! current_user_can( 'edit_post', $post_id ) )
+                                return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
+                }
                 $attachment = array(
                         'post_title' => $name,
                         'post_content' => '',