Changeset 5670

Timestamp:

06/08/2007 05:06:58 PM (16 years ago)

Author:

rob1n

Message:

Check the user before overwriting the attachment. Props xknown and Joseph Scott. fixes #4422

File:

• branches/2.2/xmlrpc.php (modified) (2 diffs)

branches/2.2/xmlrpc.php

@@ -1438 +1438 @@
         $bits = $data['bits'];
 
+        logIO('O', '(MW) Received '.strlen($bits).' bytes');
+
+        if ( !$this->login_pass_ok($user_login, $user_pass) )
+            return $this->error;
+
+        set_current_user(0, $user_login);
+        if ( !current_user_can('upload_files') ) {
+            logIO('O', '(MW) User does not have upload_files capability');
+            $this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
+            return $this->error;
+        }
+
+        if ( $upload_err = apply_filters( "pre_upload_error", false ) )
+            return new IXR_Error(500, $upload_err);
+
         if(!empty($data["overwrite"]) && ($data["overwrite"] == true)) {
             // Get postmeta info on the object.
@@ -1455 +1470 @@
             $name = "wpid{$old_file->ID}-{$filename}";
         }
-
-        logIO('O', '(MW) Received '.strlen($bits).' bytes');
-
-        if ( !$this->login_pass_ok($user_login, $user_pass) )
-            return $this->error;
-
-        set_current_user(0, $user_login);
-        if ( !current_user_can('upload_files') ) {
-            logIO('O', '(MW) User does not have upload_files capability');
-            $this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
-            return $this->error;
-        }
-
-        if ( $upload_err = apply_filters( "pre_upload_error", false ) )
-            return new IXR_Error(500, $upload_err);
 
         $upload = wp_upload_bits($name, $type, $bits, $overwrite);