IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Replace check_permissions() with ajax_user_can(). New method returns true/false to current_user_can(), which we then handle in admin ajax. see #15326.

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@16992 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
nacin
2010-12-16 09:18:28 +00:00
parent 117be6ae19
commit a189f21c45
15 changed files with 47 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/admin-ajax.php
+12 -4
View File
@@ -61,7 +61,9 @@ case 'fetch-list' :
if ( ! $wp_list_table )
die( '0' );
$wp_list_table->check_permissions();
if ( ! $wp_list_table->ajax_user_can() )
die( '-1' );
$wp_list_table->ajax_response();
die( '0' );
@@ -1200,12 +1202,18 @@ case 'inline-save':
case 'inline-save-tax':
check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
set_current_screen( 'edit-' . $_POST['taxonomy'] );
$taxonomy = sanitize_key( $_POST['taxonomy'] );
$tax = get_taxonomy( $taxonomy );
if ( ! $tax )
die( '0' );
if ( ! current_user_can( $tax->cap->edit_terms ) )
die( '-1' );
set_current_screen( 'edit-' . $taxonomy );
$wp_list_table = get_list_table('WP_Terms_List_Table');
$wp_list_table->check_permissions('edit');
if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
die(-1);