WordPress.org

Make WordPress Core

Ticket #22622: 22622.2.diff

File 22622.2.diff, 2.2 KB (added by nacin, 5 years ago)
  • wp-admin/async-upload.php

     
    1313else
    1414        require_once('../wp-load.php');
    1515
    16 // Flash often fails to send cookies with the POST or upload, so we need to pass it in GET or POST instead
    17 if ( is_ssl() && empty($_COOKIE[SECURE_AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
    18         $_COOKIE[SECURE_AUTH_COOKIE] = $_REQUEST['auth_cookie'];
    19 elseif ( empty($_COOKIE[AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
    20         $_COOKIE[AUTH_COOKIE] = $_REQUEST['auth_cookie'];
    21 if ( empty($_COOKIE[LOGGED_IN_COOKIE]) && !empty($_REQUEST['logged_in_cookie']) )
    22         $_COOKIE[LOGGED_IN_COOKIE] = $_REQUEST['logged_in_cookie'];
    23 unset($current_user);
     16if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['action'] ) ) {
     17        // Flash often fails to send cookies with the POST or upload, so we need to pass it in GET or POST instead
     18        if ( is_ssl() && empty($_COOKIE[SECURE_AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
     19                $_COOKIE[SECURE_AUTH_COOKIE] = $_REQUEST['auth_cookie'];
     20        elseif ( empty($_COOKIE[AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
     21                $_COOKIE[AUTH_COOKIE] = $_REQUEST['auth_cookie'];
     22        if ( empty($_COOKIE[LOGGED_IN_COOKIE]) && !empty($_REQUEST['logged_in_cookie']) )
     23                $_COOKIE[LOGGED_IN_COOKIE] = $_REQUEST['logged_in_cookie'];
     24        unset($current_user);
     25}
     26
    2427require_once('./admin.php');
    2528
    26 header('Content-Type: text/html; charset=' . get_option('blog_charset'));
    27 
    2829if ( !current_user_can('upload_files') )
    2930        wp_die(__('You do not have permission to upload files.'));
    3031
     32header('Content-Type: text/html; charset=' . get_option('blog_charset'));
     33
     34if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
     35        include ABSPATH . 'wp-admin/includes/ajax-actions.php';
     36
     37        send_nosniff_header();
     38        nocache_headers();
     39
     40        do_action( 'wp_ajax_upload_attachment' );
     41        die( '0' );
     42}
     43
    3144// just fetch the detail form for that attachment
    3245if ( isset($_REQUEST['attachment_id']) && ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
    3346        $post = get_post( $id );