Changeset 44051 for branches/4.9/src/wp-admin/includes/class-wp-screen.php

Timestamp:

12/13/2018 01:32:07 AM (6 years ago)

Author:

peterwilsoncc

Message:

Multisite: Validate activation links.

Merges [44048] to the 4.9 branch.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/class-wp-screen.php (modified) (1 diff)

branches/4.9/src/wp-admin/includes/class-wp-screen.php

@@ -271 +271 @@
             switch ( $base ) {
                 case 'post' :
-                    if ( isset( $_GET['post'] ) )
+                    if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] )
+                        wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+                    elseif ( isset( $_GET['post'] ) )
                         $post_id = (int) $_GET['post'];
                     elseif ( isset( $_POST['post_ID'] ) )