s9y/additional_plugins — Issue #4: function_entries / serendipity_updertEntry permission check?
Author: brockhaus
Created: 2011-12-31 03:26:05+00:00
State: open

While updating an article there is this code:

if (isset($serendipity['GET']['adminModule']) && $serendipity['GET']['adminModule'] == 'entries' && $entry['authorid'] != $serendipity['authorid'] && !serendipity_checkPermission('adminEntriesMaintainOthers')) {
// Only chiefs and admins can change other's entry. Else update fails.
return;
}

Why is this check done only when adminModule is found in GET and not always?

When called anywhere from the plugins (xml-rpc i.e.) no permission check is executed..