Changeset 9452 for trunk/wp-includes/post.php

Timestamp:

10/31/2008 11:14:37 PM (17 years ago)

Author:

azaozz

Message:

Do cap check when shoving a preview

File:

• trunk/wp-includes/post.php (modified) (1 diff)

trunk/wp-includes/post.php

@@ -3558 +3558 @@
         $post_ID = (int) $_GET['wp_preview'];
 
-        if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) )
+        if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) || ! current_user_can('edit_post', $post_ID) )
             wp_die( __('You do not have permission to preview drafts.') );