Changeset 21048

Timestamp:

06/10/2012 05:37:49 PM (13 years ago)

Author:

ryan

Message:

Restrict post IDs

File:

• trunk/wp-admin/media-upload.php (modified) (3 diffs)

trunk/wp-admin/media-upload.php

@@ -38 +38 @@
     $errors = array();
 
+    if ( ! empty( $_REQUEST['post_id'] ) && ! current_user_can( 'edit_post' , $_REQUEST['post_id'] ) )
+        wp_die( __( 'Cheatin’ uh?' ) );
+
     if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
         check_admin_referer('media-form');
@@ -59 +62 @@
         exit;
     }
+
+    if ( isset( $_REQUEST['post_id'] ) )
+        wp_die( __( 'Cheatin’ uh?' ) );
 
     $title = __('Upload New Media');
@@ -117 +123 @@
 
 } else {
+    if ( ! empty( $_REQUEST['post_id'] ) && ! current_user_can( 'edit_post' , $_REQUEST['post_id'] ) )
+        wp_die( __( 'Cheatin’ uh?' ) );
 
     // upload type: image, video, file, ..?