[wp-trac] [WordPress Trac] #31236: wp_ajax_upload_attachment does not properly handle situation when post_id is set

[WordPress Trac]

#31236: wp_ajax_upload_attachment does not properly handle situation when post_id
is set
-------------------------------+---------------------
 Reporter:  johncacpro         |       Owner:  (none)
     Type:  defect (bug)       |      Status:  new
 Priority:  normal             |   Milestone:
Component:  Media              |     Version:  4.1
 Severity:  normal             |  Resolution:
 Keywords:  reporter-feedback  |     Focuses:
-------------------------------+---------------------

Comment (by michaelbliem):

 it is a bug, but not because of 'edit_post'-cap.

 i run into the same problem and debugged the ajax-call a bit.
 problem is, that $_REQUEST('post_id') is set, but with an id that has
 nothing to do with the call! i have no idea, where this id comes from,
 seems like random for me!?

 because post_id is set, caps are checked of user for this id. when a user
 doesn't have 'edit_other_posts'-cap, but has 'edit_posts'-cap this call
 will be declined if he is not post_author of the post with post_id. as
 post_id is a 'random' id, most of the time this call fails...

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/31236#comment:11>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform