WordPress.org
Get WordPress

Make WordPress Core

Opened 18 years ago

Closed 18 years ago

Last modified 18 years ago

#6838 closed defect (bug) (fixed)

Any user is able to edit attachments

Reported by: xknown Owned by:
Priority: normal Milestone: 2.5.1
Component: Security Version: 2.5
Severity: normal Keywords:
Cc: Focuses:

Description

Any user that knows the ID of an attachment is able to edit some attributes of it.

Steps to reproduce the problem:

  1. Log in as an unprivileged user.
  2. Access directly to the following URL:

http://site/wp/wp-admin/media.php?action=edit&attachment_id=ATTACHMENT_ID

  1. Press "Save Changes" button.

Attachments (2)

6838.patch​ (408 bytes ) - added by xknown 18 years ago.
Check upload_files capability
6838.diff​ (639 bytes ) - added by mdawaffe 18 years ago.

Download all attachments as: .zip

Change History (7)

@xknown
18 years ago

Check upload_files capability

#1 @ryan
18 years ago

(In [7827]) Add cap checks. see #6838

#2 @ryan
18 years ago

(In [7828]) Add cap checks. see #6838

#3 @ryan
18 years ago

I tried it with an edit_post check.

@mdawaffe
18 years ago

#4 @ryan
18 years ago

  • Resolution → fixed
  • Status new → closed

(In [7829]) Move cap check up. Props mdawaffe. fixes #6838 for trunk

#5 @ryan
18 years ago

(In [7830]) Move cap check up. Props mdawaffe. fixes #6838 for trunk

Note: See TracTickets for help on using tickets.