Code Quality: Short-circuit Ajax handlers when the supplied post does not exist.

`get_post()` returns `null` for a nonexistent post, but four Ajax handlers dereferenced the result without checking: `wp_ajax_add_meta()`, `wp_ajax_inline_save()`, `wp_ajax_save_attachment()`, and `wp_ajax_save_attachment_compat()`. Each now bails when `null` is returned. Since these functions return `never`, subsequent references to `$post` do not cause static analysis errors. In `wp_ajax_add_meta()` the check is folded into the existing capability check, since `$post` is only dereferenced in the branch that adds meta.

These paths are unreachable in core, as `current_user_can( 'edit_post', ... )` already blocks for a nonexistent post. The guards are defensive as a plugin filtering capabilities could still reach them, and they give static analysis the non-null narrowing it needs.

Developed as subset of WordPress#12488.
Follow-up to r62704, r62703.

See #64898.


git-svn-id: https://develop.svn.wordpress.org/trunk@62705 602fd350-edb4-49c9-b593-d223f7449a82

Author: westonruter

src/wp-admin/includes/ajax-actions.php

@@ -1621,7 +1621,7 @@ function wp_ajax_add_meta() {
 	$post    = get_post( $post_id );
 
 	if ( isset( $_POST['metakeyselect'] ) || isset( $_POST['metakeyinput'] ) ) {
-		if ( ! current_user_can( 'edit_post', $post_id ) ) {
+		if ( ! $post || ! current_user_can( 'edit_post', $post_id ) ) {
 			wp_die( -1 );
 		}
 
@@ -2106,6 +2106,9 @@ function wp_ajax_inline_save() {
 	$data = &$_POST;
 
 	$post = get_post( $post_id, ARRAY_A );
+	if ( ! $post ) {
+		wp_die();
+	}
 
 	// Since it's coming from the database.
 	$post = wp_slash( $post );
@@ -3134,6 +3137,9 @@ function wp_ajax_save_attachment() {
 
 	$changes = $_REQUEST['changes'];
 	$post    = get_post( $id, ARRAY_A );
+	if ( ! $post ) {
+		wp_send_json_error();
+	}
 
 	if ( 'attachment' !== $post['post_type'] ) {
 		wp_send_json_error();
@@ -3225,6 +3231,9 @@ function wp_ajax_save_attachment_compat() {
 	}
 
 	$post = get_post( $id, ARRAY_A );
+	if ( ! $post ) {
+		wp_send_json_error();
+	}
 
 	if ( 'attachment' !== $post['post_type'] ) {
 		wp_send_json_error();