Ticket #6838: 6838.patch

wp-admin/media.php

@@ -2 +2 @@
 
 require_once('admin.php');
 
+if ( !current_user_can('upload_files') )
+        wp_die( __('You do not have sufficient permissions to access this page.') );
+
 $parent_file = 'edit.php';
 $submenu_file = 'upload.php';