From 9cbd3def678782d2573a8c1ad9b2eacc52a3e5e2 Mon Sep 17 00:00:00 2001 From: ryan Date: Mon, 23 Apr 2012 21:41:50 +0000 Subject: [PATCH] Require the edit_posts capability for wp_getPostFormats. Props maxcutler. Fixes #20154 git-svn-id: http://svn.automattic.com/wordpress/trunk@20566 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/class-wp-xmlrpc-server.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index ff5691df0d..be7b4f5b54 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -2922,6 +2922,9 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user = $this->login( $username, $password ) ) return $this->error; + if ( !current_user_can( 'edit_posts' ) ) + return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + do_action( 'xmlrpc_call', 'wp.getPostFormats' ); $formats = get_post_format_strings();