Skip to content

Commit 8cd0596

Browse files
committed
code rabbit code issues
1 parent 95e08fb commit 8cd0596

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

includes/Ajax/Frontend_Form_Ajax.php

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -229,20 +229,21 @@ public function submit_post() {
229229
if ( isset( $_POST['post_id'] ) ) {
230230
$post_id = intval( wp_unslash( $_POST['post_id'] ) );
231231

232+
// Verify the post exists
233+
$post = get_post( $post_id );
234+
if ( ! $post || is_wp_error( $post ) ) {
235+
wpuf()->ajax->send_error( __( 'Post not found.', 'wp-user-frontend' ) );
236+
}
237+
232238
// Security: Check if user has permission to edit this post (Broken Access Control fix)
233239
$post_author = get_post_field( 'post_author', $post_id );
234240
$current_user_id = get_current_user_id();
235241

236242
// Allow edit if: user is post author OR user has edit_others_posts capability
237-
if ( $current_user_id != $post_author && ! current_user_can( 'edit_others_posts' ) ) {
243+
if ( $current_user_id !== $post_author && ! current_user_can( 'edit_others_posts' ) ) {
238244
wpuf()->ajax->send_error( __( 'You do not have permission to edit this post.', 'wp-user-frontend' ) );
239245
}
240246

241-
// Verify the post exists
242-
if ( ! get_post( $post_id ) ) {
243-
wpuf()->ajax->send_error( __( 'Post not found.', 'wp-user-frontend' ) );
244-
}
245-
246247
$is_update = true;
247248
$postarr['ID'] = $post_id;
248249
$postarr['post_date'] = isset( $_POST['post_date'] ) ? sanitize_text_field( wp_unslash( $_POST['post_date'] ) ) : '';

0 commit comments

Comments
 (0)