diff --git a/wp-admin/press-this.php b/wp-admin/press-this.php index 9773364850..a91a12c52c 100644 --- a/wp-admin/press-this.php +++ b/wp-admin/press-this.php @@ -32,8 +32,25 @@ function press_it() { if ( !current_user_can('edit_post', $post_ID) ) wp_die(__('You are not allowed to edit this post.')); - $post['post_category'] = isset($_POST['post_category']) ? $_POST['post_category'] : ''; - $post['tax_input'] = isset($_POST['tax_input']) ? $_POST['tax_input'] : ''; + // Only accept categories if the user actually can assign + $category_tax = get_taxonomy( 'category' ); + if ( current_user_can( $category_tax->cap->assign_terms ) ) { + $post['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(); + } + + // Only accept taxonomies if the user can actually assign + if ( ! empty( $_POST['tax_input'] ) ) { + $tax_input = $_POST['tax_input']; + foreach ( $tax_input as $tax => $_ti ) { + $tax_object = get_taxonomy( $tax ); + if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) { + unset( $tax_input[ $tax ] ); + } + } + + $post['tax_input'] = $tax_input; + } + $post['post_title'] = isset($_POST['title']) ? $_POST['title'] : ''; $content = isset($_POST['content']) ? $_POST['content'] : ''; @@ -523,75 +540,81 @@ $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( - -
- - cap->edit_terms) ) : ?> -
- - - - 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '— ' . $tax->labels->parent_item . ' —' ) ); ?> - - - -
+ - -