WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disallow changing the post type in mw_editPost(). see #18429 

git-svn-id: http://svn.automattic.com/wordpress/trunk@19914 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2012-02-13 21:01:55 +00:00
parent f906c35510
commit 6158ce7244
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
wp-includes/class-wp-xmlrpc-server.php
View File

@ -3168,6 +3168,14 @@ class wp_xmlrpc_server extends IXR_Server {
if ( ! current_user_can( 'edit_post', $post_ID ) )
return new IXR_Error( 401, __( 'Sorry, you do not have the right to edit this post.' ) );
// Use wp.editPost to edit post types other than post and page.
if ( ! in_array( $postdata[ 'post_type' ], array( 'post', 'page' ) ) )
return new IXR_Error( 401, __( 'Invalid post type.' ) );
// Thwart attempt to change the post type.
if ( ! empty( $content_struct[ 'post_type' ] ) && ( $content_struct['post_type'] != $postdata[ 'post_type' ] ) )
return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
// Check for a valid post format if one was given
if ( isset( $content_struct['wp_post_format'] ) ) {
$content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
@ -3197,6 +3205,9 @@ class wp_xmlrpc_server extends IXR_Server {
if ( isset($content_struct['wp_page_order']) )
$menu_order = $content_struct['wp_page_order'];
if ( ! empty( $content_struct['wp_page_template'] ) && 'page' == $post_type )
$page_template = $content_struct['wp_page_template'];
$post_author = $postdata['post_author'];
// Only set the post_author if one is set.