mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-02-24 16:43:06 +01:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Check the user before overwriting the attachment. Props xknown and Joseph Scott. fixes #4422

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@5671 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
rob1n 2007-06-08 17:07:59 +00:00
parent 4726ebca94
commit ab82e6cf1e
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
xmlrpc.php
View File

@ -1429,6 +1429,21 @@ class wp_xmlrpc_server extends IXR_Server {
$type = $data['type'];
$bits = $data['bits'];
logIO('O', '(MW) Received '.strlen($bits).' bytes');
if ( !$this->login_pass_ok($user_login, $user_pass) )
return $this->error;
set_current_user(0, $user_login);
if ( !current_user_can('upload_files') ) {
logIO('O', '(MW) User does not have upload_files capability');
$this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
return $this->error;
}
if ( $upload_err = apply_filters( "pre_upload_error", false ) )
return new IXR_Error(500, $upload_err);
if(!empty($data["overwrite"]) && ($data["overwrite"] == true)) {
// Get postmeta info on the object.
$old_file = $wpdb->get_row("
@ -1447,21 +1462,6 @@ class wp_xmlrpc_server extends IXR_Server {
$name = "wpid{$old_file->ID}-{$filename}";
}
logIO('O', '(MW) Received '.strlen($bits).' bytes');
if ( !$this->login_pass_ok($user_login, $user_pass) )
return $this->error;
set_current_user(0, $user_login);
if ( !current_user_can('upload_files') ) {
logIO('O', '(MW) User does not have upload_files capability');
$this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
return $this->error;
}
if ( $upload_err = apply_filters( "pre_upload_error", false ) )
return new IXR_Error(500, $upload_err);
$upload = wp_upload_bits($name, $type, $bits, $overwrite);
if ( ! empty($upload['error']) ) {
$errorString = sprintf(__('Could not write file %1$s (%2$s)'), $name, $upload['error']);