Make WordPress Core


Ignore:
Timestamp:
12/04/2012 06:33:51 PM (12 years ago)
Author:
ryan
Message:

Only show Delete in media modal if the user can delete.

Props nacin, koopersmith
fixes #22711

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/includes/ajax-actions.php

    r22994 r23032  
    18131813        wp_send_json_error();
    18141814
    1815     if ( ! current_user_can( 'read_post', $id ) )
     1815    if ( ! $post = get_post( $id ) )
     1816        wp_send_json_error();
     1817
     1818    if ( 'attachment' != $post->post_type )
     1819        wp_send_json_error();
     1820
     1821    if ( ! current_user_can( 'upload_files' ) )
    18161822        wp_send_json_error();
    18171823
     
    18281834 */
    18291835function wp_ajax_query_attachments() {
     1836    if ( ! current_user_can( 'upload_files' ) )
     1837        wp_send_json_error();
     1838
    18301839    $query = isset( $_REQUEST['query'] ) ? (array) $_REQUEST['query'] : array();
    18311840    $query = array_intersect_key( $query, array_flip( array(
     
    19891998        wp_send_json_error();
    19901999
    1991     if ( ! current_user_can( 'edit_post', $id ) )
    1992         wp_send_json_error();
    1993 
    19942000    if ( 'attachment' != $post->post_type )
    19952001        wp_send_json_error();
    19962002
    1997     // If this attachment is unattached, attach it. Primarily a back compat thing.
    1998     if ( 0 == $post->post_parent && $insert_into_post_id = intval( $_POST['post_id'] ) ) {
    1999         wp_update_post( array( 'ID' => $id, 'post_parent' => $insert_into_post_id ) );
     2003    if ( current_user_can( 'edit_post', $id ) ) {
     2004        // If this attachment is unattached, attach it. Primarily a back compat thing.
     2005        if ( 0 == $post->post_parent && $insert_into_post_id = intval( $_POST['post_id'] ) ) {
     2006            wp_update_post( array( 'ID' => $id, 'post_parent' => $insert_into_post_id ) );
     2007        }
    20002008    }
    20012009
Note: See TracChangeset for help on using the changeset viewer.