Changes from trunk/wp-admin/admin-ajax.php at r17354 to branches/3.1/wp-admin/admin-ajax.php at r18018

File:

• branches/3.1/wp-admin/admin-ajax.php (modified) (2 diffs)

branches/3.1/wp-admin/admin-ajax.php

@@ -397 +397 @@
         die('1');
 
-    if ( !current_user_can( 'edit_post', $meta->post_id ) )
+    if ( !current_user_can( 'edit_post', $meta->post_id ) || is_protected_meta( $meta->meta_key ) )
         die('-1');
     if ( delete_meta( $meta->meta_id ) )
@@ -856 +856 @@
         if ( !current_user_can( 'edit_post', $meta->post_id ) )
             die('-1');
+        if ( is_protected_meta( $meta->meta_key ) )
+            die('-1');
         if ( $meta->meta_value != stripslashes($value) || $meta->meta_key != stripslashes($key) ) {
             if ( !$u = update_meta( $mid, $key, $value ) )