Changes from trunk/wp-admin/admin-ajax.php at r17354 to branches/3.1/wp-admin/admin-ajax.php at r18018

File:

• branches/3.1/wp-admin/admin-ajax.php (modified) (2 diffs)

branches/3.1/wp-admin/admin-ajax.php

@@ -397 +397 @@
                 die('1');
 
-        if ( !current_user_can( 'edit_post', $meta->post_id ) )
+        if ( !current_user_can( 'edit_post', $meta->post_id ) || is_protected_meta( $meta->meta_key ) )
                 die('-1');
         if ( delete_meta( $meta->meta_id ) )
@@ -856 +856 @@
                 if ( !current_user_can( 'edit_post', $meta->post_id ) )
                         die('-1');
+                if ( is_protected_meta( $meta->meta_key ) )
+                        die('-1');
                 if ( $meta->meta_value != stripslashes($value) || $meta->meta_key != stripslashes($key) ) {
                         if ( !$u = update_meta( $mid, $key, $value ) )