Changeset 17392 for branches/3.1

Timestamp:

02/05/2011 06:24:05 PM (14 years ago)

Author:

ryan

Message:

Add cap and type checks to media item fetch. For 3.1

File:

• branches/3.1/wp-admin/async-upload.php (modified) (1 diff)

branches/3.1/wp-admin/async-upload.php

@@ -31 +31 @@
 // just fetch the detail form for that attachment
 if ( isset($_REQUEST['attachment_id']) && ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
+    $post = get_post( $id );
+    if ( 'attachment' != $post->post_type )
+        wp_die( __( 'Unknown post type.' ) );
+    $post_type_object = get_post_type_object( 'attachment' );
+    if ( ! current_user_can( $post_type_object->cap->edit_post, $id ) )
+        wp_die( __( 'You are not allowed to edit this item.' ) );
+
     if ( 2 == $_REQUEST['fetch'] ) {
         add_filter('attachment_fields_to_edit', 'media_single_attachment_fields_to_edit', 10, 2);