| @@ -1005,8 +1005,14 @@ | ||
| 1005 | 1005 | wpforo_verify_nonce( 'wpforo_post_edit' ); |
| 1006 | 1006 | $r = [ 'html' => '' ]; |
| 1007 | 1007 | if( $postid = wpforo_bigintval( wpfval( $_POST, 'postid' ) ) ) { |
| 1008 | 1008 | if( $post = WPF()->post->get_post( $postid, false ) ) { |
| 1009 | + // forum_can() is a usergroup-level check and takes no post id, so for | |
| 1010 | + // guests it cannot prove ownership of THIS post. Without this gate the | |
| 1011 | + // edit form (post body + a valid form nonce) is handed to any visitor. | |
| 1012 | + if( ! is_user_logged_in() && ! wpforo_guest_owns_post( $postid ) ) { | |
| 1013 | + wp_send_json_error( $r ); | |
| 1014 | + } | |
| 1009 | 1015 | if( WPF()->perm->forum_can( 'eor', $post['forumid'] ) || WPF()->perm->forum_can( |
| 1010 | 1016 | 'eot', |
| 1011 | 1017 | $post['forumid'] |
| 1012 | 1018 | ) ) { |
