Changeset 44048 for trunk/src/wp-admin/includes/class-wp-screen.php

Timestamp:

12/13/2018 01:25:03 AM (6 years ago)

Author:

peterwilsoncc

Message:

Multisite: Validate activation links.

File:

• trunk/src/wp-admin/includes/class-wp-screen.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-screen.php

@@ -273 +273 @@
             switch ( $base ) {
                 case 'post':
-                    if ( isset( $_GET['post'] ) ) {
+                    if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] ) {
+                        wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+                    } elseif ( isset( $_GET['post'] ) ) {
                         $post_id = (int) $_GET['post'];
                     } elseif ( isset( $_POST['post_ID'] ) ) {