Changeset 49389

Timestamp:

10/29/2020 06:26:20 PM (4 years ago)

Author:

whyisjake

Message:

XML-RPC: Improve error messages for unprivileged users.

Add specific permission checks to avoid ambiguous failure messages.

This brings the changes in [49380] to the 5.5 branch.

Props zieladam, peterwilsoncc, xknown, whyisjake.

Location:

branches/5.5

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

branches/5.5/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3876 +3876 @@
         }
 
+        if (
+            'publish' === get_post_status( $post_id ) &&
+            ! current_user_can( 'edit_post', $post_id ) &&
+            post_password_required( $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
+        if (
+            'private' === get_post_status( $post_id ) &&
+            ! current_user_can( 'read_post', $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
         if ( empty( $content_struct['content'] ) ) {
             return new IXR_Error( 403, __( 'Comment is required.' ) );