Skip to content

Commit

Permalink
Remove post type from post nonces. Fixes attachment deletion when EMP…
Browse files Browse the repository at this point in the history 
…TY_TRASH_DAYS is 0. Props c3mdigital, kurtpayne, SergeyBiryukov. fixes #21194

git-svn-id: https://develop.svn.wordpress.org/trunk@21504 602fd350-edb4-49c9-b593-d223f7449a82
  • Loading branch information
@ryanboren
ryanboren committed Aug 14, 2012
1 parent 665ad96 commit 4974f5f
Show file tree
Hide file tree
Showing 9 changed files with 25 additions and 21 deletions.
4 changes: 3 additions & 1 deletion wp-admin/css/colors-classic.dev.css
View file
Original file line number Diff line number Diff line change
Expand Up @@ -516,7 +516,8 @@ div.dashboard-widget-submit input:hover,
}

.submitbox .submitdelete:hover,
#media-items a.delete:hover {
#media-items a.delete:hover,
#media-items a.delete-permanently:hover {
color: #fff;
background-color: #f00;
border-bottom-color: #f00;
Expand Down Expand Up @@ -607,6 +608,7 @@ a,
#the-comment-list p.comment-author strong a,
#media-upload a.del-link,
#media-items a.delete,
#media-items a.delete-permanently,
.plugins a.delete,
.ui-tabs-nav a {
color: #21759b;
Expand Down
4 changes: 3 additions & 1 deletion wp-admin/css/colors-fresh.dev.css
View file
Original file line number Diff line number Diff line change
Expand Up @@ -507,7 +507,8 @@ div.dashboard-widget-submit input:hover,
}

.submitbox .submitdelete:hover,
#media-items a.delete:hover {
#media-items a.delete:hover,
#media-items a.delete-permanently:hover {
color: #fff;
background-color: #f00;
border-bottom-color: #f00;
Expand Down Expand Up @@ -598,6 +599,7 @@ a,
#the-comment-list p.comment-author strong a,
#media-upload a.del-link,
#media-items a.delete,
#media-items a.delete-permanently,
.plugins a.delete,
.ui-tabs-nav a {
color: #21759b;
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit-form-advanced.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@
}

$form_action = 'editpost';
$nonce_action = 'update-' . $post_type . '_' . $post_ID;
$nonce_action = 'update-post_' . $post_ID;
$form_extra .= "<input type='hidden' id='post_ID' name='post_ID' value='" . esc_attr($post_ID) . "' />";

// Detect if there exists an autosave newer than the post and if that autosave is different than the post
Expand Down
4 changes: 2 additions & 2 deletions wp-admin/includes/ajax-actions.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1727,7 +1727,7 @@ function wp_ajax_wp_fullscreen_save_post() {
elseif ( isset( $_POST['post_type'] ) && post_type_exists( $_POST['post_type'] ) )
$post_type = $_POST['post_type'];

check_ajax_referer('update-' . $post_type . '_' . $post_id, '_wpnonce');
check_ajax_referer('update-post_' . $post_id, '_wpnonce');

$post_id = edit_post();

Expand Down Expand Up @@ -1769,7 +1769,7 @@ function wp_ajax_wp_remove_post_lock() {
if ( ! $post = get_post( $post_id ) )
wp_die( 0 );

check_ajax_referer( 'update-' . $post->post_type . '_' . $post_id );
check_ajax_referer( 'update-post_' . $post_id );

if ( ! current_user_can( 'edit_post', $post_id ) )
wp_die( -1 );
Expand Down
10 changes: 5 additions & 5 deletions wp-admin/includes/class-wp-media-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -360,10 +360,10 @@ function _get_row_actions( $post, $att_title ) {
$actions['edit'] = '<a href="' . get_edit_post_link( $post->ID, true ) . '">' . __( 'Edit' ) . '</a>';
if ( current_user_can( 'delete_post', $post->ID ) )
if ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) {
$actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
$actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-post_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
} else {
$delete_ays = !MEDIA_TRASH ? " onclick='return showNotice.warn();'" : '';
$actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
$actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
}
$actions['view'] = '<a href="' . get_permalink( $post->ID ) . '" title="' . esc_attr( sprintf( __( 'View &#8220;%s&#8221;' ), $att_title ) ) . '" rel="permalink">' . __( 'View' ) . '</a>';
if ( current_user_can( 'edit_post', $post->ID ) )
Expand All @@ -374,12 +374,12 @@ function _get_row_actions( $post, $att_title ) {
$actions['edit'] = '<a href="' . get_edit_post_link( $post->ID, true ) . '">' . __( 'Edit' ) . '</a>';
if ( current_user_can( 'delete_post', $post->ID ) ) {
if ( $this->is_trash )
$actions['untrash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-attachment_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
$actions['untrash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-post_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
elseif ( EMPTY_TRASH_DAYS && MEDIA_TRASH )
$actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
$actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-post_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
if ( $this->is_trash || !EMPTY_TRASH_DAYS || !MEDIA_TRASH ) {
$delete_ays = ( !$this->is_trash && !MEDIA_TRASH ) ? " onclick='return showNotice.warn();'" : '';
$actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
$actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
}
}
if ( !$this->is_trash ) {
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-posts-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -545,7 +545,7 @@ function single_row( $a_post, $level = 0 ) {
}
if ( current_user_can( $post_type_object->cap->delete_post, $post->ID ) ) {
if ( 'trash' == $post->post_status )
$actions['untrash'] = "<a title='" . esc_attr( __( 'Restore this item from the Trash' ) ) . "' href='" . wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $post->ID ) ), 'untrash-' . $post->post_type . '_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
$actions['untrash'] = "<a title='" . esc_attr( __( 'Restore this item from the Trash' ) ) . "' href='" . wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $post->ID ) ), 'untrash-post_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
elseif ( EMPTY_TRASH_DAYS )
$actions['trash'] = "<a class='submitdelete' title='" . esc_attr( __( 'Move this item to the Trash' ) ) . "' href='" . get_delete_post_link( $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
if ( 'trash' == $post->post_status || !EMPTY_TRASH_DAYS )
Expand Down
8 changes: 4 additions & 4 deletions wp-admin/includes/media.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1156,16 +1156,16 @@ function get_media_item( $attachment_id, $args = null ) {
$send = get_submit_button( __( 'Insert into Post' ), 'button', "send[$attachment_id]", false );
if ( $delete && current_user_can( 'delete_post', $attachment_id ) ) {
if ( !EMPTY_TRASH_DAYS ) {
$delete = "<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Delete Permanently' ) . '</a>';
$delete = "<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-post_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete-permanently'>" . __( 'Delete Permanently' ) . '</a>';
} elseif ( !MEDIA_TRASH ) {
$delete = "<a href='#' class='del-link' onclick=\"document.getElementById('del_attachment_$attachment_id').style.display='block';return false;\">" . __( 'Delete' ) . "</a>
<div id='del_attachment_$attachment_id' class='del-attachment' style='display:none;'><p>" . sprintf( __( 'You are about to delete <strong>%s</strong>.' ), $filename ) . "</p>
<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='button'>" . __( 'Continue' ) . "</a>
<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-post_' . $attachment_id ) . "' id='del[$attachment_id]' class='button'>" . __( 'Continue' ) . "</a>
<a href='#' class='button' onclick=\"this.parentNode.style.display='none';return false;\">" . __( 'Cancel' ) . "</a>
</div>";
} else {
$delete = "<a href='" . wp_nonce_url( "post.php?action=trash&amp;post=$attachment_id", 'trash-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Move to Trash' ) . "</a>
<a href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$attachment_id", 'untrash-attachment_' . $attachment_id ) . "' id='undo[$attachment_id]' class='undo hidden'>" . __( 'Undo' ) . "</a>";
$delete = "<a href='" . wp_nonce_url( "post.php?action=trash&amp;post=$attachment_id", 'trash-post_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Move to Trash' ) . "</a>
<a href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$attachment_id", 'untrash-post_' . $attachment_id ) . "' id='undo[$attachment_id]' class='undo hidden'>" . __( 'Undo' ) . "</a>";
}
} else {
$delete = '';
Expand Down
10 changes: 5 additions & 5 deletions wp-admin/post.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ function redirect_post($post_id = '') {
break;

case 'editattachment':
check_admin_referer('update-attachment_' . $post_id);
check_admin_referer('update-post_' . $post_id);

// Don't let these be changed
unset($_POST['guid']);
Expand All @@ -190,7 +190,7 @@ function redirect_post($post_id = '') {
wp_update_attachment_metadata( $post_id, $newmeta );

case 'editpost':
check_admin_referer('update-' . $post_type . '_' . $post_id);
check_admin_referer('update-post_' . $post_id);

$post_id = edit_post();

Expand All @@ -200,7 +200,7 @@ function redirect_post($post_id = '') {
break;

case 'trash':
check_admin_referer('trash-' . $post_type . '_' . $post_id);
check_admin_referer('trash-post_' . $post_id);

$post = & get_post($post_id);

Expand All @@ -215,7 +215,7 @@ function redirect_post($post_id = '') {
break;

case 'untrash':
check_admin_referer('untrash-' . $post_type . '_' . $post_id);
check_admin_referer('untrash-post_' . $post_id);

if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
wp_die( __('You are not allowed to move this item out of the Trash.') );
Expand All @@ -228,7 +228,7 @@ function redirect_post($post_id = '') {
break;

case 'delete':
check_admin_referer('delete-' . $post_type . '_' . $post_id);
check_admin_referer('delete-post_' . $post_id);

if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
wp_die( __('You are not allowed to delete this item.') );
Expand Down
2 changes: 1 addition & 1 deletion wp-includes/link-template.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -971,7 +971,7 @@ function get_delete_post_link( $id = 0, $deprecated = '', $force_delete = false

$delete_link = add_query_arg( 'action', $action, admin_url( sprintf( $post_type_object->_edit_link, $post->ID ) ) );

return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-{$post->post_type}_{$post->ID}" ), $post->ID, $force_delete );
return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-post_{$post->ID}" ), $post->ID, $force_delete );
}

/**
Expand Down

0 comments on commit 4974f5f

Please sign in to comment.