Ticket #32565: 32565.3.diff

src/wp-admin/includes/ajax-actions.php

@@ -1244 +1244 @@
                                         ) );
                                         $x->send();
                                 }
-
-                                if ( !$mid = add_meta( $pid ) )
-                                        wp_die( __( 'Please provide a custom field value.' ) );
                         } else {
                                 wp_die( 0 );
                         }
-                } elseif ( ! $mid = add_meta( $pid ) ) {
-                        wp_die( __( 'Please provide a custom field value.' ) );
                 }
+                $mid = add_meta( $pid );
+                if ( false === $mid ) {
+                        $metakeyselect = isset( $_POST['metakeyselect'] ) ? wp_unslash( trim( $_POST['metakeyselect'] ) ) : '';
+                        $metakeyinput = isset( $_POST['metakeyinput'] ) ? wp_unslash( trim( $_POST['metakeyinput'] ) ) : '';
+                        $metavalue = isset( $_POST['metavalue'] ) ? $_POST['metavalue'] : '';
+                        if ( '#NONE#' !== $metakeyselect ) {
+                                $metakey = $metakeyselect;
+                        }
+                        if ( ! empty( $metakeyinput ) ) {
+                                $metakey = $metakeyinput;
+                        }
+                        if ( is_protected_meta( $metakey, 'post' ) || ! current_user_can( 'add_post_meta', $pid, $metakey ) ) {
+                                wp_die( __( 'You are not allowed to edit this custom field.' ) );
+                        } else {
+                                wp_die( __( 'Please provide a custom field value.' ) );
+                        }
+                }
 
                 $meta = get_metadata_by_mid( 'post', $mid );
                 $pid = (int) $meta->post_id;