From 4b3374e66d4eec764bae3601805ab29061531bd1 Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Tue, 23 Aug 2011 10:22:34 +0000 Subject: [PATCH] Check for comment existence before checking edit_comment meta cap. props xknown, fixes #18104. git-svn-id: https://develop.svn.wordpress.org/trunk@18584 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/class-wp-xmlrpc-server.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index 9179f615f1..0d56daf1e9 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -1134,14 +1134,14 @@ class wp_xmlrpc_server extends IXR_Server { if ( !current_user_can( 'moderate_comments' ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); + if ( ! get_comment($comment_ID) ) + return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); + if ( !current_user_can( 'edit_comment', $comment_ID ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); do_action('xmlrpc_call', 'wp.deleteComment'); - if ( ! get_comment($comment_ID) ) - return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); - return wp_delete_comment($comment_ID); } @@ -1184,14 +1184,14 @@ class wp_xmlrpc_server extends IXR_Server { if ( !current_user_can( 'moderate_comments' ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); + if ( ! get_comment($comment_ID) ) + return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); + if ( !current_user_can( 'edit_comment', $comment_ID ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); do_action('xmlrpc_call', 'wp.editComment'); - if ( ! get_comment($comment_ID) ) - return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); - if ( isset($content_struct['status']) ) { $statuses = get_comment_statuses(); $statuses = array_keys($statuses);