Changeset 25430 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

09/13/2013 09:21:16 PM (11 years ago)

Author:

wonderboymusic

Message:

• Avoid notices in tests/ajax/Autosave by bailing early when get_post() returns nothing.
• Check for the existence of $_POST['catslist'] before using it in wp_ajax_autosave().

See #25282.

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -1048 +1048 @@
     check_ajax_referer( 'autosave', 'autosavenonce' );
 
-    $_POST['post_category'] = explode(",", $_POST['catslist']);
-    if ( $_POST['post_type'] == 'page' || empty($_POST['post_category']) )
-        unset($_POST['post_category']);
+    if ( ! empty( $_POST['catslist'] ) )
+        $_POST['post_category'] = explode( ',', $_POST['catslist'] );
+    if ( $_POST['post_type'] == 'page' || empty( $_POST['post_category'] ) )
+        unset( $_POST['post_category'] );
 
     $data = '';
@@ -1058 +1059 @@
     $post_id = (int) $_POST['post_id'];
     $_POST['ID'] = $_POST['post_ID'] = $post_id;
-    $post = get_post($post_id);
+    $post = get_post( $post_id );
+    if ( empty( $post->ID ) || ! current_user_can( 'edit_post', $post->ID ) )
+        wp_die( __( 'You are not allowed to edit this post.' ) );
+
+    if ( 'page' == $post->post_type && ! current_user_can( 'edit_page', $post->ID ) )
+        wp_die( __( 'You are not allowed to edit this page.' ) );
+
     if ( 'auto-draft' == $post->post_status )
         $_POST['post_status'] = 'draft';
-
-    if ( 'page' == $post->post_type ) {
-        if ( !current_user_can('edit_page', $post->ID) )
-            wp_die( __( 'You are not allowed to edit this page.' ) );
-    } else {
-        if ( !current_user_can('edit_post', $post->ID) )
-            wp_die( __( 'You are not allowed to edit this post.' ) );
-    }
 
     if ( ! empty( $_POST['autosave'] ) ) {