From 7e45462cbd8982b07b05eb77ba2cb2f2b1dbe7e0 Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Mon, 23 Apr 2012 21:41:50 +0000
Subject: [PATCH] Require the edit_posts capability for wp_getPostFormats.

Props maxcutler.
Fixes #20154


git-svn-id: https://develop.svn.wordpress.org/trunk@20566 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/class-wp-xmlrpc-server.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index ff5691df0d..be7b4f5b54 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -2922,6 +2922,9 @@ class wp_xmlrpc_server extends IXR_Server {
 		if ( !$user = $this->login( $username, $password ) )
 			return $this->error;
 
+		if ( !current_user_can( 'edit_posts' ) )
+			return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) );
+
 		do_action( 'xmlrpc_call', 'wp.getPostFormats' );
 
 		$formats = get_post_format_strings();