WordPress.org

Make WordPress Core

Changeset 18366


Ignore:
Timestamp:
06/28/2011 09:45:31 PM (9 years ago)
Author:
ryan
Message:

Perform a cap check on attachments in media_upload_form_handler(). For 3.1

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/3.1/wp-admin/includes/media.php

    r18356 r18366  
    428428    if ( !empty($_POST['attachments']) ) foreach ( $_POST['attachments'] as $attachment_id => $attachment ) {
    429429        $post = $_post = get_post($attachment_id, ARRAY_A);
     430        $post_type_object = get_post_type_object( $post[ 'post_type' ] );
     431
     432        if ( !current_user_can( $post_type_object->cap->edit_post, $attachment_id ) )
     433            continue;
     434
    430435        if ( isset($attachment['post_content']) )
    431436            $post['post_content'] = $attachment['post_content'];
Note: See TracChangeset for help on using the changeset viewer.