Ticket #22572: 22572.3.patch

wp-admin/includes/media.php

@@ -2166 +2166 @@
  * @since 2.6.0
  */
 function media_upload_flash_bypass() {
+        $browser_uploader = admin_url( 'media-new.php?browser-uploader' );
+
+        $post = get_post();
+        if ( ! empty( $post ) )
+                $browser_uploader = add_query_arg( 'post_id', $post->ID, $browser_uploader );
+
         ?>
         <p class="upload-flash-bypass">
-        <?php printf( __( 'You are using the multi-file uploader. Problems? Try the <a href="%1$s" target="%2$s">browser uploader</a> instead.' ), admin_url( 'media-new.php?browser-uploader' ), '_blank' ); ?>
+        <?php printf( __( 'You are using the multi-file uploader. Problems? Try the <a href="%1$s" target="%2$s">browser uploader</a> instead.' ), $browser_uploader, '_blank' ); ?>
         </p>
         <?php
 }

wp-admin/media-new.php

@@ -17 +17 @@
 
 wp_enqueue_script('plupload-handlers');
 
-unset( $_REQUEST['post_id'] );
+$post_id = ! empty( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 
 if ( $_POST ) {
+        if ( ! empty( $post_id ) && ! current_user_can( 'edit_post' , $post_id ) )
+                wp_die( __( 'Cheatin’ uh?' ) );
+
         $location = 'upload.php';
         if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
                 check_admin_referer('media-form');
                 // Upload File button was clicked
-                $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
+                $id = media_handle_upload('async-upload', $post_id);
                 if ( is_wp_error( $id ) )
                         $location .= '?message=3';
         }
         wp_redirect( admin_url( $location ) );
         exit;
+} else if ( ! empty( $post_id ) ) {
+        // post_id is only allowed for browser upload
+        wp_die( __( 'Cheatin’ uh?' ) );
 }
 
 $title = __('Upload New Media');
@@ -68 +74 @@
         <?php media_upload_form(); ?>
 
         <script type="text/javascript">
-        var post_id = 0, shortform = 3;
+        var post_id = <?php echo $post_id; ?>, shortform = 3;
         </script>
-        <input type="hidden" name="post_id" id="post_id" value="0" />
+        <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
         <?php wp_nonce_field('media-form'); ?>
         <div id="media-items" class="hide-if-no-js"></div>
         </form>