diff --git a/wp-admin/post.php b/wp-admin/post.php index 8835482548..e63b6b4bf6 100644 --- a/wp-admin/post.php +++ b/wp-admin/post.php @@ -173,10 +173,9 @@ case 'edit': $post = $post_ID = $p = (int) $_GET['post']; - if (!user_can_edit_post($user_ID, $post_ID)) { + if ( !user_can_edit_post($user_ID, $post_ID) ) die ('You are not allowed to edit this post.'); - } - + $postdata = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = '$post_ID'"); $content = $postdata->post_content; $content = format_to_edit($content); @@ -196,6 +195,9 @@ case 'edit': $post_parent = $postdata->post_parent; $post_author = $postdata->post_author; + if( 'private' == $postdata->post_status && $postdata->post_author != $user_ID ) + die ('You are not allowed to view other users\' private posts.'); + if ($post_status == 'static') { $page_template = get_post_meta($post_ID, '_wp_page_template', true); include('edit-page-form.php');