Ticket #12122: 12122.2.diff

wp-admin/admin-ajax.php

@@ -14 +14 @@
 define('DOING_AJAX', true);
 define('WP_ADMIN', true);
 
+if ( ! isset( $_REQUEST['action'] ) )
+        die('-1');
+
 require_once('../wp-load.php');
 require_once('includes/admin.php');
 @header('Content-Type: text/html; charset=' . get_option('blog_charset'));
@@ -22 +25 @@
 
 if ( ! is_user_logged_in() ) {
 
-        if ( $_POST['action'] == 'autosave' ) {
+        if ( isset( $_POST['action'] ) && $_POST['action'] == 'autosave' ) {
                 $id = isset($_POST['post_ID'])? (int) $_POST['post_ID'] : 0;
 
                 if ( ! $id )