Opened 13 months ago

Last modified 13 months ago

#20453 new defect (bug)

Media screen links to non-public post types

Reported by: johnbillion Owned by:
Priority: normal Milestone: Awaiting Review
Component: Administration Version:
Severity: normal Keywords: 2nd-opinion
Cc:

Description

I have a non-public custom post type registered, so it doesn't get an admin UI.

A file in the media library is attached to one of my custom posts (done at the point the file is uploaded using media_handle_upload()). The media item shows up in the Media Library as expected, but the 'Attached To' column links to the editing screen for the parent post, even though the post is non-public.

This allows a user to see the post editing screen for a non-public post type.

Attachments (1)

20453.patch (910 bytes) - added by johnbillion 13 months ago.

Download all attachments as: .zip

Change History (3)

  • Keywords 2nd-opinion added

Attached is my patch. I fully expect this to have side effects, so this needs input from others.

Additionally, the existing logic which checks the return value of get_post() on line 298 looks erroneous to me. If it returns false then the $title variable is not going to be as expected.

Given your patch, by non-public, I assume you mean non-show_ui. In that case, patch looks good.

Note: See TracTickets for help on using tickets.