Skip to content

Fix ContentImporter permission and post type checks #612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lloc merged 4 commits into from
Apr 20, 2026
Merged

Fix ContentImporter permission and post type checks #612

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1d0b575
fix(import): add read_post permission check
apermo Apr 15, 2026
fddc7c6
fix(import): check post_type_exists on target blog
apermo Apr 15, 2026
f3c5327
refactor(import): combine blog switch for read
apermo Apr 15, 2026
4c5b87a
Merge branch 'master' into fix/610-611-content-importer-security
lloc Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions includes/ContentImport/ContentImporter.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,15 @@ public function handle_import( array $data = array() ) {
return $data;
}

switch_to_blog( $source_blog_id );
$can_read = current_user_can( 'read_post', $source_post_id );
$source_post = get_post( $source_post_id );
restore_current_blog();

if ( ! $can_read || ! $source_post instanceof \WP_Post ) {
return $data;
}
Comment thread
apermo marked this conversation as resolved.

$source_lang = MslsBlogCollection::get_blog_language( $source_blog_id );
$dest_blog_id = get_current_blog_id();
$dest_lang = MslsBlogCollection::get_blog_language( get_current_blog_id() );
Expand All @@ -120,14 +129,6 @@ public function handle_import( array $data = array() ) {
return $data;
}

switch_to_blog( $source_blog_id );
$source_post = get_post( $source_post_id );
restore_current_blog();

if ( ! $source_post instanceof \WP_Post ) {
return $data;
}

$import_coordinates = new ImportCoordinates();

$import_coordinates->source_blog_id = $source_blog_id;
Expand Down Expand Up @@ -234,6 +235,12 @@ protected function insert_blog_post( $blog_id, array $data = array() ) {

switch_to_blog( $blog_id );

if ( ! empty( $data['post_type'] ) && ! post_type_exists( $data['post_type'] ) ) {
restore_current_blog();

return false;
}

$this->handle( false );
if ( isset( $data['ID'] ) ) {
$post_id = wp_update_post( $data );
Expand Down
Loading