Ticket #15276: 15276.diff

post.php

@@ -192 +192 @@
 
         // Meta Stuff
         if ( isset($post_data['meta']) && $post_data['meta'] ) {
-                foreach ( $post_data['meta'] as $key => $value )
+                foreach ( $post_data['meta'] as $key => $value ) {
+                        if ( !$meta = get_post_meta_by_id( $key ) )
+                                continue;
+                        if ( !current_user_can( 'edit_post', $meta->post_id ) )
+                                continue;
                         update_meta( $key, $value['key'], $value['value'] );
+                }
         }
 
         if ( isset($post_data['deletemeta']) && $post_data['deletemeta'] ) {
-                foreach ( $post_data['deletemeta'] as $key => $value )
+                foreach ( $post_data['deletemeta'] as $key => $value ) {
+                        if ( !$meta = get_post_meta_by_id( $key ) )
+                                continue;
+                        if ( !current_user_can( 'edit_post', $meta->post_id ) )
+                                continue;
                         delete_meta( $key );
+                }
         }
 
         add_meta( $post_ID );