Changeset 7828

Timestamp:

04/25/08 15:01:28 (7 months ago)

Author:

ryan

Message:

Add cap checks. see #6838

Files:

• branches/2.5/wp-admin/media.php (modified) (2 diffs)

branches/2.5/wp-admin/media.php

@@ -12 +12 @@
-    $errors = media_upload_form_handler();
-    $attachment_id = (int) $_POST['attachment_id'];
+
+    check_admin_referer('media-form');
+
+    if ( !current_user_can('edit_post', $attachment_id) )
+        wp_die ( __('You are not allowed to edit this attachment.') );
+
-    if ( empty($errors) ) {
-        $location = 'media.php';
@@ -40 +46 @@
-    }
-    $att_id = (int) $_GET['attachment_id'];
+
+    if ( !current_user_can('edit_post', $att_id) )
+        wp_die ( __('You are not allowed to edit this attachment.') );
+
-    $att = get_post($att_id);
-