Changeset 21087

Timestamp:

06/15/2012 05:52:59 PM (14 years ago)

Author:

markjaquith

Message:

Restrict post IDs

Backports [21048] for the 3.3 branch.

File:

• branches/3.3/wp-admin/media-upload.php (modified) (3 diffs)

branches/3.3/wp-admin/media-upload.php

@@ -37 +37 @@
         $errors = array();
 
+        if ( ! empty( $_REQUEST['post_id'] ) && ! current_user_can( 'edit_post' , $_REQUEST['post_id'] ) )
+                wp_die( __( 'Cheatin’ uh?' ) );
+
         if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
                 check_admin_referer('media-form');
@@ -58 +61 @@
                 exit;
         }
+
+        if ( isset( $_REQUEST['post_id'] ) )
+                wp_die( __( 'Cheatin’ uh?' ) );
 
         $title = __('Upload New Media');
@@ -116 +122 @@
 
 } else {
+        if ( ! empty( $_REQUEST['post_id'] ) && ! current_user_can( 'edit_post' , $_REQUEST['post_id'] ) )
+                wp_die( __( 'Cheatin’ uh?' ) );
 
         // upload type: image, video, file, ..?