XMLRPC: Add a check in mw.newPost to stop the authorID being changed to an invalid value. Fixes #20356 props maxcutler.

git-svn-id: http://svn.automattic.com/wordpress/trunk@20351 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-04-04 20:11:21 +00:00 · 2012-04-04 20:11:21 +00:00 · 4b31ce3cd2
parent 3738a692a3
commit 4b31ce3cd2
1 changed files with 3 additions and 0 deletions
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@ -3615,6 +3615,9 @@ class wp_xmlrpc_server extends IXR_Server {
 					return(new IXR_Error(401, __('Invalid post type.')));
 					break;
 			}
+			$author = get_userdata( $content_struct['wp_author_id'] );
+			if ( ! $author )
+				return new IXR_Error( 404, __( 'Invalid author ID.' ) );
 			$post_author = $content_struct['wp_author_id'];
 		}