Opened 12 months ago
Closed 12 months ago
#3650 closed enhancement (fixed)
Check caps on parent objects in new/edit handlers
| Reported by: | johnjamesjacoby | Owned by: | johnjamesjacoby |
|---|---|---|---|
| Priority: | high | Milestone: | 2.7 |
| Component: | Component - Any/All | Version: | 2.0 |
| Severity: | normal | Keywords: | needs-patch |
| Cc: |
Description
When creating or editing any forum/topic/reply, we do not currently perform any capability checks on the parent IDs in the following functions:
- bbp_new_reply_handler
- bbp_edit_reply_handler
- bbp_new_topic_handler
- bbp_edit_topic_handler
- bbp_new_forum_handler
- bbp_edit_forum_handler
Luckily, bbPress protects against this causing any problems in a number of other ways later in the code execution path of these post actions and their template parts.
That being said, I think it's worth checking for, and adding error messages for as well.
Attachments (3)
Change History (4)
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Map anonymous users to 'spectate' in 2 more places