Changeset 63715 for branches/4.7/src/wp-admin/includes/post.php

Timestamp:

09/17/2026 09:15:04 PM (10 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 4.7 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63659, r63660, r63665, r63669, r63672 to the 4.7 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/post.php (modified) (1 diff)

branches/4.7/src/wp-admin/includes/post.php

@@ -23 +23 @@
         if ( empty($post_data) )
                 $post_data = &$_POST;
+
+        /*
+         * A raw `ID` on the create path (no `post_ID`) is an attempt to overwrite an
+         * existing post while bypassing the per-post capability checks below, which only
+         * run on the update path. Reject it outright: legitimate post creation never
+         * carries an `ID`.
+         */
+        if ( ! $update && ! empty( $post_data['ID'] ) ) {
+                if ( 'page' === $post_data['post_type'] ) {
+                        return new WP_Error( 'edit_others_pages', __( 'Sorry, you are not allowed to edit pages as this user.' ) );
+                } else {
+                        return new WP_Error( 'edit_others_posts', __( 'Sorry, you are not allowed to edit posts as this user.' ) );
+                }
+        }
 
         if ( $update )