diff --git a/wp-admin/wp-post.php b/wp-admin/wp-post.php index 49d6207b5..1f524686c 100644 --- a/wp-admin/wp-post.php +++ b/wp-admin/wp-post.php @@ -350,10 +350,17 @@ switch($action) { if ($user_level == 0) die ('Cheatin’ uh?'); + $comment = $HTTP_GET_VARS['comment']; $p = $HTTP_GET_VARS['p']; + + $postdata = get_postdata($p) or die('Oops, no post with this ID. Go back!'); $commentdata = get_commentdata($comment) or die('Oops, no comment with this ID. Go back!'); + $authordata = get_userdata($postdata['Author_ID']); + if ($user_level < $authordata->user_level) + die ('You don’t have the right to delete '.$authordata->user_nickname.'’s post comments. Go back!'); + $result = $wpdb->query("DELETE FROM $tablecomments WHERE comment_ID=$comment"); if($HTTP_SERVER_VARS['HTTP_REFERER'] != "") {