Changeset 62843

Timestamp:

09/17/2026 05:40:12 PM (5 weeks ago)

Author:

adamsilverstein

Message:

Administration: Add authorization check to wp_ajax_sample_permalink().

Props peterwilsoncc, westonruter, jorbin.

Built from ​https://develop.svn.wordpress.org/trunk@63669

Location:

trunk

Files:

• wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• wp-includes/version.php (modified) (1 diff)

trunk/wp-admin/includes/ajax-actions.php

@@ -2060 +2060 @@
         check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? (int) $_POST['post_id'] : 0;
+        if ( ! $post_id ) {
+                // Bypass call to get_preview_post_link() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
         wp_die( get_preview_post_link( $post_id ) );
 }
@@ -2071 +2078 @@
         check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? (int) $_POST['post_id'] : 0;
-        $title   = $_POST['new_title'] ?? '';
-        $slug    = $_POST['new_slug'] ?? null;
+        if ( ! $post_id ) {
+                // Bypass call to get_sample_permalink_html() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
+        $title = $_POST['new_title'] ?? '';
+        $slug  = $_POST['new_slug'] ?? null;
         wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
 }

trunk/wp-includes/version.php

@@ -17 +17 @@
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63665';
+$wp_version = '7.2-alpha-63669';
 
 /**