Ticket #24280: 24280.patch

wp-includes/class-wp-xmlrpc-server.php

@@ -1179 +1179 @@
                         if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) )
                                 return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
                 } else {
-                        if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) )
+                        if ( ! current_user_can( $post_type->cap->create_posts ) && ! current_user_can( $post_type->cap->edit_posts ) )
                                 return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
                 }
 
@@ -5647 +5647 @@
                 if ( ! $postdata )
                         return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
-                if ( !current_user_can('publish_posts') || !current_user_can('edit_post', $post_ID) )
+                if ( !current_user_can('publish_posts') && !current_user_can('edit_post', $post_ID) )
                         return new IXR_Error(401, __('Sorry, you cannot publish this post.'));
 
                 $postdata['post_status'] = 'publish';