WordPress.org
Get WordPress

Make WordPress Core

Opened 14 years ago

Closed 14 years ago

Last modified 14 years ago

#20474 closed defect (bug) (invalid)

cap fixes in _wp_insert_post

Reported by: nprasath002 Owned by: ryan
Priority: normal Milestone:
Component: XML-RPC Version: 3.4
Severity: critical Keywords:
Cc: Focuses:

Description

The patch validates 'publish_post' with post_ID to check whether the user is allowed to publish an already existing post

Attachments (1)

_insert_post cap fixes.patch​ (1.8 KB ) - added by nprasath002 14 years ago.

Download all attachments as: .zip

Change History (12)

@nprasath002
14 years ago

#1 @maxcutler
14 years ago

  • Milestone Awaiting Review → 3.4

#2 @ryan
14 years ago

  • Owner set to ryan
  • Resolution → fixed
  • Status new → closed

In [20568]:

Check the publish_post cap when publishing an already existing post.

Props nprasath002
Fixes #20474

#3 @nacin
14 years ago

  • Resolution fixed
  • Status closed → reopened

There isn't a publish_post cap...

#4 @scribu
14 years ago

The magic of meta caps: current_user_can( 'publish_post', $post_data[ 'ID' ] ) )

That should work with all post types, right?

#5 @scribu
14 years ago

  • Keywords needs-patch added; has-patch removed

#6 @ryan
14 years ago

Well hell I thought we added that.

#7 @ryan
14 years ago

get_post_type_capabilities() would also need an update. Probably not worth it for 3.4, but I think I'd like to finally do publish_post in 3.5 since this happens all the time.

#8 @ryan
14 years ago

In [20576]:

Revert [20568] until a publish_post cap is introduced. see #20474

#9 @ryan
14 years ago

There are edit_post/edit_posts checks above this block. I think all cap bases are covered.

#10 @maxcutler
14 years ago

  • Resolution → invalid
  • Status reopened → closed

#11 @SergeyBiryukov
14 years ago

  • Keywords needs-patch removed
  • Milestone 3.4
Note: See TracTickets for help on using tickets.