From acf73adf61b180e1bba0aeeb92d2dcf30f980fe3 Mon Sep 17 00:00:00 2001 From: Andrew Ozz Date: Fri, 31 Oct 2008 23:14:37 +0000 Subject: [PATCH] Do cap check when shoving a preview git-svn-id: https://develop.svn.wordpress.org/trunk@9452 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wp-includes/post.php b/wp-includes/post.php index 68b2c90564..eab3d9f7b4 100644 --- a/wp-includes/post.php +++ b/wp-includes/post.php @@ -3557,7 +3557,7 @@ function _show_post_preview() { if ( isset($_GET['wp_preview']) && isset($_GET['preview_nonce']) ) { $post_ID = (int) $_GET['wp_preview']; - if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) ) + if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $post_ID ) || ! current_user_can('edit_post', $post_ID) ) wp_die( __('You do not have permission to preview drafts.') ); $q = array(