Ticket #33763: 33763.2.diff

src/wp-admin/edit.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once( dirname( __FILE__ ) . '/admin.php' );
 
-if ( ! $typenow )
+if ( ! $typenow ) {
         wp_die( __( 'Invalid post type' ) );
+}
+
+if ( ! in_array( $typenow, get_post_types( array( 'show_ui' => true ) ) ) ) {
+        wp_die( __( 'You are not allowed to edit posts in this post type.' ) );
+}
 
 if ( 'attachment' === $typenow ) {
         if ( wp_redirect( admin_url( 'upload.php' ) ) ) {

src/wp-admin/post.php

@@ -109 +109 @@
         if ( ! $post_type_object )
                 wp_die( __( 'Unknown post type.' ) );
 
+        if ( ! in_array( $typenow, get_post_types( array( 'show_ui' => true ) ) ) ) {
+                wp_die( __( 'You are not allowed to edit posts in this post type.' ) );
+        }
+
         if ( ! current_user_can( 'edit_post', $post_id ) )
                 wp_die( __( 'You are not allowed to edit this item.' ) );