media-upload.php should check whether current user can edit a particular post type
|Reported by:||danielbachhuber||Owned by:|
In /wp-admin/media-upload.php, there are a few checks for:
if ( ! empty( $_REQUEST['post_id'] ) && ! current_user_can( 'edit_post' , $_REQUEST['post_id'] ) ) wp_die( __( 'Cheatin’ uh?' ) );
These should instead be (something like):
$obj = get_post_type_object( get_post_type( $_REQUEST['ID'] ) ); if ( ! current_user_can( $obj->cap->edit_post, $_REQUEST['ID' ) ) wp_die( __( 'Cheatin’ uh?' ) );
Although $obj->cap->edit_post can map to 'edit_post', sometimes map_meta_cap is bypassed in which case uploading media doesn't work.
Change History (8)
- Component changed from General to Role/Capability
- Keywords reporter-feedback added
- Keywords reporter-feedback removed
- Resolution set to wontfix
- Status changed from new to closed
Note: See TracTickets for help on using tickets.