Changeset 23636 for trunk/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

03/07/2013 06:52:37 AM (12 years ago)

Author:

nacin

Message:

XML-RPC: Return an error for getRecentPosts (mw and blogger) if the user does not have edit_posts.

props redsweater.
fixes #22320.

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -3785 +3785 @@
             return $this->error;
 
+        if ( ! current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) );
+
         do_action('xmlrpc_call', 'blogger.getRecentPosts');
 
@@ -4757 +4760 @@
         if ( !$user = $this->login($username, $password) )
             return $this->error;
+
+        if ( ! current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) );
 
         do_action('xmlrpc_call', 'metaWeblog.getRecentPosts');