Ticket #24916: FixMetaWeblogChangeAuthorToSelf.patch

wp-includes/class-wp-xmlrpc-server.php

@@ -4424 +4424 @@
                 $post_author = $postdata['post_author'];
 
                 // Only set the post_author if one is set.
-                if ( isset($content_struct['wp_author_id']) && ($user->ID != $content_struct['wp_author_id']) ) {
-                        switch ( $post_type ) {
-                                case 'post':
-                                        if ( !current_user_can('edit_others_posts') )
-                                                return(new IXR_Error(401, __('You are not allowed to change the post author as this user.')));
-                                        break;
-                                case 'page':
-                                        if ( !current_user_can('edit_others_pages') )
-                                                return(new IXR_Error(401, __('You are not allowed to change the page author as this user.')));
-                                        break;
-                                default:
-                                        return(new IXR_Error(401, __('Invalid post type')));
-                                        break;
+                if ( isset($content_struct['wp_author_id']) ) {
+                        // Check permissions if attempting to switch author to or from another user
+                        if ( ( $user->ID != $content_struct['wp_author_id'] ) || ( $user->ID != $post_author) ) {
+                                switch ( $post_type ) {
+                                        case 'post':
+                                                if ( !current_user_can('edit_others_posts') )
+                                                        return(new IXR_Error(401, __('You are not allowed to change the post author as this user.')));
+                                                break;
+                                        case 'page':
+                                                if ( !current_user_can('edit_others_pages') )
+                                                        return(new IXR_Error(401, __('You are not allowed to change the page author as this user.')));
+                                                break;
+                                        default:
+                                                return(new IXR_Error(401, __('Invalid post type')));
+                                                break;
+                                }
                         }
                         $post_author = $content_struct['wp_author_id'];
                 }