From b793c730cd1fc2d2221726209353380bf127edcb Mon Sep 17 00:00:00 2001
From: ryan <ryan@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Mon, 25 Sep 2006 02:54:23 +0000
Subject: [PATCH] Don't show user form without privs. Props westi. fixes #3142

git-svn-id: http://svn.automattic.com/wordpress/branches/2.0@4244 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/user-edit.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php
index 0bcdb04377..60d293e29d 100644
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -21,6 +21,11 @@ for ($i=0; $i<count($wpvarstoreset); $i += 1) {
 	}
 }
 
+$user_id = (int) $user_id;
+
+if ( !$user_id )
+	die(__('Invalid user ID.'));
+
 switch ($action) {
 case 'switchposts':
 
@@ -37,7 +42,7 @@ check_admin_referer('update-user_' . $user_id);
 $errors = array();
 
 if (!current_user_can('edit_users'))
-	$errors['head'] = __('You do not have permission to edit this user.');
+	die(__('You do not have permission to edit this user.'));
 else
 	$errors = edit_user($user_id);
 
@@ -51,7 +56,9 @@ include ('admin-header.php');
 
 $profileuser = get_user_to_edit($user_id);
 
-if (!current_user_can('edit_users')) $errors['head'] = __('You do not have permission to edit this user.');
+if (!current_user_can('edit_users')) 
+	die__('You do not have permission to edit this user.');
+
 ?>
 
 <?php if ( isset($_GET['updated']) ) : ?>