Changeset 21137

Timestamp:

06/26/2012 07:04:10 PM (12 years ago)

Author:

nacin

Message:

Check XML-RPC cap before running the query. props maxcutler. see #20991 for trunk.

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (3 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -1338 +1338 @@
 
         $post_type = get_post_type_object( $post['post_type'] );
-        if ( ! current_user_can( $post_type->cap->edit_posts, $post_id ) )
+        if ( ! current_user_can( $post_type->cap->edit_post, $post_id ) )
             return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
 
@@ -1395 +1395 @@
             if ( ! ( (bool) $post_type ) )
                 return new IXR_Error( 403, __( 'The post type specified is not valid' ) );
-
-            if ( ! current_user_can( $post_type->cap->edit_posts ) )
-                return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type' ));
-
-            $query['post_type'] = $filter['post_type'];
-        }
+        } else {
+            $post_type = get_post_type_object( 'post' );
+        }
+
+        if ( ! current_user_can( $post_type->cap->edit_posts ) )
+            return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type' ));
+
+        $query['post_type'] = $post_type->name;
 
         if ( isset( $filter['post_status'] ) )
@@ -1428 +1430 @@
         foreach ( $posts_list as $post ) {
             $post_type = get_post_type_object( $post['post_type'] );
-            if ( ! current_user_can( $post_type->cap->edit_posts, $post['ID'] ) )
+            if ( ! current_user_can( $post_type->cap->edit_post, $post['ID'] ) )
                 continue;