diff --git a/wp-admin/press-this.php b/wp-admin/press-this.php index 9773364850..a91a12c52c 100644 --- a/wp-admin/press-this.php +++ b/wp-admin/press-this.php @@ -32,8 +32,25 @@ function press_it() { if ( !current_user_can('edit_post', $post_ID) ) wp_die(__('You are not allowed to edit this post.')); - $post['post_category'] = isset($_POST['post_category']) ? $_POST['post_category'] : ''; - $post['tax_input'] = isset($_POST['tax_input']) ? $_POST['tax_input'] : ''; + // Only accept categories if the user actually can assign + $category_tax = get_taxonomy( 'category' ); + if ( current_user_can( $category_tax->cap->assign_terms ) ) { + $post['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(); + } + + // Only accept taxonomies if the user can actually assign + if ( ! empty( $_POST['tax_input'] ) ) { + $tax_input = $_POST['tax_input']; + foreach ( $tax_input as $tax => $_ti ) { + $tax_object = get_taxonomy( $tax ); + if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) { + unset( $tax_input[ $tax ] ); + } + } + + $post['tax_input'] = $tax_input; + } + $post['post_title'] = isset($_POST['title']) ? $_POST['title'] : ''; $content = isset($_POST['content']) ? $_POST['content'] : ''; @@ -523,75 +540,81 @@ $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( - -
-

-

-
-
+ -
  • labels->all_items; ?>
  • -
  • - + $tax = get_taxonomy( 'category' ); + if ( current_user_can( $tax->cap->assign_terms ) ) : + ?> +
    +

    +

    +
    +
    - -
    -
      - 'category', 'popular_cats' => $popular_ids ) ) ?> -
    -
    - - cap->assign_terms) ) : ?> -

    - - cap->edit_terms) ) : ?> -
    -

    - - labels->add_new_item ); ?> - -

    -

    - - - - 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '— ' . $tax->labels->parent_item . ' —' ) ); ?> - - - -

    + - -
    -
    -
    -
    -

    -

    -
    -
    -
    - - -
    - - +
    +
      + 'category', 'popular_cats' => $popular_ids ) ) ?> +
    +
    + + cap->edit_terms) ) : ?> +
    +

    + + labels->add_new_item ); ?> + +

    +

    + + + + 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '— ' . $tax->labels->parent_item . ' —' ) ); ?> + + + +

    -
    -
    + +
    -
    -
    + cap->assign_terms ) ) : + ?> +
    +

    +

    +
    +
    +
    + + +
    + + +
    +
    +
    +
    + +
    +
    +