From 4b31ce3cd23432bc17e78e897266a005371dae10 Mon Sep 17 00:00:00 2001 From: westi Date: Wed, 4 Apr 2012 20:11:21 +0000 Subject: [PATCH] XMLRPC: Add a check in mw.newPost to stop the authorID being changed to an invalid value. Fixes #20356 props maxcutler. git-svn-id: http://svn.automattic.com/wordpress/trunk@20351 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/class-wp-xmlrpc-server.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index d937eb153e..1f7fca05fc 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -3615,6 +3615,9 @@ class wp_xmlrpc_server extends IXR_Server { return(new IXR_Error(401, __('Invalid post type.'))); break; } + $author = get_userdata( $content_struct['wp_author_id'] ); + if ( ! $author ) + return new IXR_Error( 404, __( 'Invalid author ID.' ) ); $post_author = $content_struct['wp_author_id']; }