Changeset 44726

Timestamp:

02/07/2019 04:11:23 AM (6 years ago)

Author:

pento

Message:

Admin: Re-add some validation from [44048] that was accidentally removed in [44165].

Props david.binda.
See #45037.

File:

• trunk/src/wp-admin/post.php (modified) (2 diffs)

trunk/src/wp-admin/post.php

@@ -17 +17 @@
 wp_reset_vars( array( 'action' ) );
 
-if ( isset( $_GET['post'] ) ) {
+if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] ) {
+    wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+} elseif ( isset( $_GET['post'] ) ) {
     $post_id = $post_ID = (int) $_GET['post'];
 } elseif ( isset( $_POST['post_ID'] ) ) {
@@ -39 +41 @@
     $post_type        = $post->post_type;
     $post_type_object = get_post_type_object( $post_type );
+}
+
+if ( isset( $_POST['post_type'] ) && $post && $post_type !== $_POST['post_type'] ) {
+    wp_die( __( 'A post type mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
 }