From 1e4e3ec57e6d6a1e1fbc26382b7cbab1be54aceb Mon Sep 17 00:00:00 2001 From: azaozz Date: Fri, 31 Oct 2008 23:14:37 +0000 Subject: [PATCH] Do cap check when shoving a preview git-svn-id: http://svn.automattic.com/wordpress/trunk@9452 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wp-includes/post.php b/wp-includes/post.php index 68b2c90564..eab3d9f7b4 100644 --- a/wp-includes/post.php +++ b/wp-includes/post.php @@ -3557,7 +3557,7 @@ function _show_post_preview() { if ( isset($_GET['wp_preview']) && isset($_GET['preview_nonce']) ) { $post_ID = (int) $_GET['wp_preview']; - if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) ) + if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) || ! current_user_can('edit_post', $post_ID) ) wp_die( __('You do not have permission to preview drafts.') ); $q = array(