wp.getPosts doesn't always check cap

[maxcutler]

The cap check against 'edit_posts' in the XML-RPC wp.getPosts method does not fire immediately when querying against the 'post' post type. For other post types ('page', 'attachment', or CPTs), the cap check will fire early and short-circuit the method execution with an error.

The cap is checked properly before outputting each post, so at worst a non-capable user will get an empty array as output. However, by that point the query will have run.

[maxcutler]

Unit test in ​[UT738].

[nacin]

In [21137]:

Check XML-RPC cap before running the query. props maxcutler. see #20991 for trunk.

[nacin]

In [21138]:

Check XML-RPC cap before running the query. props maxcutler. fixes #20991 for 3.4.