Changeset 3456

Timestamp:

01/18/2006 07:16:31 PM (18 years ago)

Author:

ryan

Message:

Check upload_files cap for inline uploader. Props David House and doit-cu. fixes #2302

Location:

trunk/wp-admin

Files:

• edit-form-advanced.php (modified) (1 diff)
• edit-page-form.php (modified) (1 diff)
• inline-uploading.php (modified) (1 diff)

trunk/wp-admin/edit-form-advanced.php

@@ -219 +219 @@
 
 <?php
-$uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
-$uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID";
-$uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
-if ( false != $uploading_iframe_src )
-    echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+if (current_user_can('upload_files')) {
+    $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
+    $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID";
+    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
+    if ( false != $uploading_iframe_src )
+        echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+}
 ?>
 

trunk/wp-admin/edit-page-form.php

@@ -185 +185 @@
 
 <?php
-$uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
-$uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID";
-$uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
-if ( false != $uploading_iframe_src )
-    echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+if (current_user_can('upload_files')) {
+    $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
+    $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID";
+    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
+    if ( false != $uploading_iframe_src )
+        echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+}
 ?>
 

trunk/wp-admin/inline-uploading.php

@@ -5 +5 @@
 header('Content-Type: text/html; charset=' . get_option('blog_charset'));
 
-if (!current_user_can('edit_posts'))
-    die(__('You do not have permission to edit posts.'));
+if (!current_user_can('upload_files'))
+    die(__('You do not have permission to upload files.'));
 
 $wpvarstoreset = array('action', 'post', 'all', 'last', 'link', 'sort', 'start', 'imgtitle', 'descr', 'attachment');