WordPress.org
Get WordPress

Plugin Directory

Changeset 2674688


Ignore:
Timestamp:
02/08/2022 01:37:58 AM (4 years ago)
Author:
allurewebsolutions
Message:

Release 3.7.0: fixed API security flaw

Location:
wp-post-modal
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • wp-post-modal/tags/3.7.0/public/class-wp-post-modal-public.php

    r2673189 r2674688  
    184184        if (!empty($post['post_password'])) {
    185185            $response = new WP_Error('post_password_protected', 'Post is password protected', array('status' => 403));
    186         } elseif ($post['post_status'] === "private") {
    187             $response = new WP_Error('post_private', 'Post is private', array('status' => 403));
    188         } elseif ($post['post_content']) {
     186        } elseif ($post['post_status'] !== "published") {
     187            $response = new WP_Error('post_private', 'Post is not published', array('status' => 403));
     188        } elseif ($post['post_content'] && $post['post_status'] === "published") {
    189189            // render shortcodes from Visual Composer
    190190            $post['post_content'] = apply_filters('the_content', $post['post_content']);

  • wp-post-modal/trunk/public/class-wp-post-modal-public.php

    r2673189 r2674688  
    184184        if (!empty($post['post_password'])) {
    185185            $response = new WP_Error('post_password_protected', 'Post is password protected', array('status' => 403));
    186         } elseif ($post['post_status'] === "private") {
    187             $response = new WP_Error('post_private', 'Post is private', array('status' => 403));
    188         } elseif ($post['post_content']) {
     186        } elseif ($post['post_status'] !== "published") {
     187            $response = new WP_Error('post_private', 'Post is not published', array('status' => 403));
     188        } elseif ($post['post_content'] && $post['post_status'] === "published") {
    189189            // render shortcodes from Visual Composer
    190190            $post['post_content'] = apply_filters('the_content', $post['post_content']);
Note: See TracChangeset for help on using the changeset viewer.