Opened 7 months ago
Closed 7 months ago
#3650 closed enhancement (fixed)
Check caps on parent objects in new/edit handlers
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Milestone: | 2.7 | Priority: | high |
| Severity: | normal | Version: | 2.0 |
| Component: | Component - Any/All | Keywords: | needs-patch |
| Cc: |
Description
When creating or editing any forum/topic/reply, we do not currently perform any capability checks on the parent IDs in the following functions:
- bbp_new_reply_handler
- bbp_edit_reply_handler
- bbp_new_topic_handler
- bbp_edit_topic_handler
- bbp_new_forum_handler
- bbp_edit_forum_handler
Luckily, bbPress protects against this causing any problems in a number of other ways later in the code execution path of these post actions and their template parts.
That being said, I think it's worth checking for, and adding error messages for as well.
Attachments (3)
Change History (4)
Note: See
TracTickets for help on using
tickets.
Map anonymous users to 'spectate' in 2 more places