From 3ee964c10c98bb8222ce0417ae6284491c38109e Mon Sep 17 00:00:00 2001 From: nacin Date: Tue, 23 Aug 2011 10:22:34 +0000 Subject: [PATCH] Check for comment existence before checking edit_comment meta cap. props xknown, fixes #18104. git-svn-id: http://svn.automattic.com/wordpress/trunk@18584 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/class-wp-xmlrpc-server.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index 9179f615f1..0d56daf1e9 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -1134,14 +1134,14 @@ class wp_xmlrpc_server extends IXR_Server { if ( !current_user_can( 'moderate_comments' ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); + if ( ! get_comment($comment_ID) ) + return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); + if ( !current_user_can( 'edit_comment', $comment_ID ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); do_action('xmlrpc_call', 'wp.deleteComment'); - if ( ! get_comment($comment_ID) ) - return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); - return wp_delete_comment($comment_ID); } @@ -1184,14 +1184,14 @@ class wp_xmlrpc_server extends IXR_Server { if ( !current_user_can( 'moderate_comments' ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); + if ( ! get_comment($comment_ID) ) + return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); + if ( !current_user_can( 'edit_comment', $comment_ID ) ) return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) ); do_action('xmlrpc_call', 'wp.editComment'); - if ( ! get_comment($comment_ID) ) - return new IXR_Error( 404, __( 'Invalid comment ID.' ) ); - if ( isset($content_struct['status']) ) { $statuses = get_comment_statuses(); $statuses = array_keys($statuses);