From 0ba9380f4ed3dd969c1b924a90d5dc68e0a38f2b Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Mon, 26 Nov 2012 23:10:19 +0000
Subject: [PATCH] In media_upload_flash_bypass(), pass the post id in the
 media-new.php url. In media-new.php, use post_id from REQUEST if passed and
 the current user can edit the post. Fixes adding media with the browser
 uploader.

Props nacin, ocean90
fixes #22572


git-svn-id: https://develop.svn.wordpress.org/trunk@22853 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-admin/includes/media.php |  9 ++++++++-
 wp-admin/media-new.php      | 13 +++++++++----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index b776967485..09e5d81e6c 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -2176,9 +2176,16 @@ function wp_media_insert_url_form( $default_view = 'image' ) {
  * @since 2.6.0
  */
 function media_upload_flash_bypass() {
+	$browser_uploader = admin_url( 'media-new.php?browser-uploader' );
+
+	if ( $post = get_post() )
+		$browser_uploader .= '&amp;post_id=' . intval( $post->ID );
+	elseif ( ! empty( $GLOBALS['post_ID'] ) )
+		$browser_uploader .= '&amp;post_id=' . intval( $GLOBALS['post_ID'] );
+
 	?>
 	<p class="upload-flash-bypass">
-	<?php printf( __( 'You are using the multi-file uploader. Problems? Try the <a href="%1$s" target="%2$s">browser uploader</a> instead.' ), admin_url( 'media-new.php?browser-uploader' ), '_blank' ); ?>
+	<?php printf( __( 'You are using the multi-file uploader. Problems? Try the <a href="%1$s" target="%2$s">browser uploader</a> instead.' ), $browser_uploader, '_blank' ); ?>
 	</p>
 	<?php
 }
diff --git a/wp-admin/media-new.php b/wp-admin/media-new.php
index b3e6a8777a..ab14160f49 100644
--- a/wp-admin/media-new.php
+++ b/wp-admin/media-new.php
@@ -17,14 +17,19 @@ if (!current_user_can('upload_files'))
 
 wp_enqueue_script('plupload-handlers');
 
-unset( $_REQUEST['post_id'] );
+$post_id = 0;
+if ( isset( $_REQUEST['post_id'] ) ) {
+	$post_id = absint( $_REQUEST['post_id'] );
+	if ( ! get_post( $post_id ) || ! current_user_can( 'edit_post', $post_id ) )
+		$post_id = 0;
+}
 
 if ( $_POST ) {
 	$location = 'upload.php';
 	if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
 		check_admin_referer('media-form');
 		// Upload File button was clicked
-		$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
+		$id = media_handle_upload( 'async-upload', $post_id );
 		if ( is_wp_error( $id ) )
 			$location .= '?message=3';
 	}
@@ -68,9 +73,9 @@ if ( get_user_setting('uploader') || isset( $_GET['browser-uploader'] ) )
 	<?php media_upload_form(); ?>
 
 	<script type="text/javascript">
-	var post_id = 0, shortform = 3;
+	var post_id = <?php echo $post_id; ?>, shortform = 3;
 	</script>
-	<input type="hidden" name="post_id" id="post_id" value="0" />
+	<input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
 	<?php wp_nonce_field('media-form'); ?>
 	<div id="media-items" class="hide-if-no-js"></div>
 	</form>