Changeset 49385

Timestamp:

10/29/2020 06:02:22 PM (4 years ago)

Author:

desrosj

Message:

XML-RPC: Return error message if attachment ID is incorrect.

Throw an error for incorrect attachment IDs when requesting a media object to ensure return signature is correct and doesn't include incorrectly typed values within the object.

Props zieladam, peterwilsoncc, whyisjake.
Merges [49376] to trunk.
See #49905.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -4312 +4312 @@
 
         $attachment = get_post( $attachment_id );
-        if ( ! $attachment ) {
+        if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
             return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
         }