Ticket #4627: 4627.diff

wp-admin/link.php

@@ -61 +61 @@
         case 'add' :
                 check_admin_referer('add-bookmark');
 
+                // check the current user's level first.
+                if (!current_user_can('manage_links'))
+                        wp_die(__('Cheatin’ uh?'));
+
                 add_link();
 
                 wp_redirect(wp_get_referer().'?added=true');
@@ -71 +75 @@
                 $link_id = (int) $_POST['link_id'];
                 check_admin_referer('update-bookmark_' . $link_id);
 
+                // check the current user's level first.
+                if (!current_user_can('manage_links'))
+                        wp_die(__('Cheatin’ uh?'));
+
                 edit_link($link_id);
 
                 wp_redirect($this_file);