Changeset 49380 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

10/29/2020 05:42:13 PM (6 years ago)

Author:

desrosj

Message:

XML-RPC: Improve error messages for unprivileged users.

Add specific permission checks to avoid ambiguous failure messages.

Props zieladam, peterwilsoncc, xknown, whyisjake.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3877 +3877 @@
                 }
 
+                if (
+                        'publish' === get_post_status( $post_id ) &&
+                        ! current_user_can( 'edit_post', $post_id ) &&
+                        post_password_required( $post_id )
+                ) {
+                        return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+                }
+
+                if (
+                        'private' === get_post_status( $post_id ) &&
+                        ! current_user_can( 'read_post', $post_id )
+                ) {
+                        return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+                }
+
                 $comment = array(
                         'comment_post_ID' => $post_id,