From a6488f3ffbe61da9e6acd9567b04275b0ba0c896 Mon Sep 17 00:00:00 2001 From: Jonathan Desrosiers Date: Thu, 29 Oct 2020 18:02:22 +0000 Subject: [PATCH] XML-RPC: Return error message if attachment ID is incorrect. Throw an error for incorrect attachment IDs when requesting a media object to ensure return signature is correct and doesn't include incorrectly typed values within the object. Props zieladam, peterwilsoncc, whyisjake. Merges [49376] to trunk. See #49905. git-svn-id: https://develop.svn.wordpress.org/trunk@49385 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/class-wp-xmlrpc-server.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php index 53566cbeff..945d659fb0 100644 --- a/src/wp-includes/class-wp-xmlrpc-server.php +++ b/src/wp-includes/class-wp-xmlrpc-server.php @@ -4311,7 +4311,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getMediaItem' ); $attachment = get_post( $attachment_id ); - if ( ! $attachment ) { + if ( ! $attachment || 'attachment' !== $attachment->post_type ) { return new IXR_Error( 404, __( 'Invalid attachment ID.' ) ); }