'post_content' => $content,
), $post_data );
+ // This should never be set as it would then overwrite an existing attachment.
+ if ( isset( $attachment['ID'] ) )
+ unset( $attachment['ID'] );
+
// Save the data
$id = wp_insert_attachment($attachment, $file, $post_id);
if ( !is_wp_error($id) ) {
'post_content' => $content,
), $post_data );
+ // This should never be set as it would then overwrite an existing attachment.
+ if ( isset( $attachment['ID'] ) )
+ unset( $attachment['ID'] );
+
// Save the attachment metadata
$id = wp_insert_attachment($attachment, $file, $post_id);
if ( !is_wp_error($id) )
if ( !empty($_POST['attachments']) ) foreach ( $_POST['attachments'] as $attachment_id => $attachment ) {
$post = $_post = get_post($attachment_id, ARRAY_A);
+ $post_type_object = get_post_type_object( $post[ 'post_type' ] );
+
+ if ( !current_user_can( $post_type_object->cap->edit_post, $attachment_id ) )
+ continue;
+
if ( isset($attachment['post_content']) )
$post['post_content'] = $attachment['post_content'];
if ( isset($attachment['post_title']) )
$id = 0;
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+ check_admin_referer('media-form');
// Upload File button was clicked
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
unset($_FILES);
$id = 0;
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+ check_admin_referer('media-form');
// Upload File button was clicked
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
unset($_FILES);
$id = 0;
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+ check_admin_referer('media-form');
// Upload File button was clicked
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
unset($_FILES);
$id = 0;
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+ check_admin_referer('media-form');
// Upload File button was clicked
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
unset($_FILES);
$toggle_on = __( 'Show' );
$toggle_off = __( 'Hide' );
- $filename = basename( $post->guid );
+ $filename = esc_html( basename( $post->guid ) );
$title = esc_attr( $post->post_title );
if ( $_tags = get_the_tags( $attachment_id ) ) {