File tree Expand file tree Collapse file tree 1 file changed +7
-6
lines changed Expand file tree Collapse file tree 1 file changed +7
-6
lines changed Original file line number Diff line number Diff line change @@ -229,20 +229,21 @@ public function submit_post() {
229229 if ( isset ( $ _POST ['post_id ' ] ) ) {
230230 $ post_id = intval ( wp_unslash ( $ _POST ['post_id ' ] ) );
231231
232+ // Verify the post exists
233+ $ post = get_post ( $ post_id );
234+ if ( ! $ post || is_wp_error ( $ post ) ) {
235+ wpuf ()->ajax ->send_error ( __ ( 'Post not found. ' , 'wp-user-frontend ' ) );
236+ }
237+
232238 // Security: Check if user has permission to edit this post (Broken Access Control fix)
233239 $ post_author = get_post_field ( 'post_author ' , $ post_id );
234240 $ current_user_id = get_current_user_id ();
235241
236242 // Allow edit if: user is post author OR user has edit_others_posts capability
237- if ( $ current_user_id != $ post_author && ! current_user_can ( 'edit_others_posts ' ) ) {
243+ if ( $ current_user_id !== $ post_author && ! current_user_can ( 'edit_others_posts ' ) ) {
238244 wpuf ()->ajax ->send_error ( __ ( 'You do not have permission to edit this post. ' , 'wp-user-frontend ' ) );
239245 }
240246
241- // Verify the post exists
242- if ( ! get_post ( $ post_id ) ) {
243- wpuf ()->ajax ->send_error ( __ ( 'Post not found. ' , 'wp-user-frontend ' ) );
244- }
245-
246247 $ is_update = true ;
247248 $ postarr ['ID ' ] = $ post_id ;
248249 $ postarr ['post_date ' ] = isset ( $ _POST ['post_date ' ] ) ? sanitize_text_field ( wp_unslash ( $ _POST ['post_date ' ] ) ) : '' ;
You can’t perform that action at this time.
0 commit comments