[wp-trac] [WordPress Trac] #24564: wp_insert_post checks permissions of the current user, not the author

[WordPress Trac]

#24564: wp_insert_post checks permissions of the current user, not the author
--------------------------+-----------------------------
 Reporter:  rmccue        |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:
 Severity:  normal        |   Keywords:
--------------------------+-----------------------------
 In `wp_insert_post()`, `current_user_can()` is called twice to check
 permissions (`publish_posts` for setting the slug and the assign terms
 capability for taxonomies.

 This global state should be removed from `wp_insert_post()` in favour of
 `user_can()` using the post's author.

--
Ticket URL: <http://core.trac.wordpress.org/ticket/24564>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software