From 15dd7f70b0b8f468a054246ef8208f67accc8627 Mon Sep 17 00:00:00 2001 From: Ryan Boren Date: Tue, 14 Aug 2012 18:39:15 +0000 Subject: [PATCH] Remove post type from post nonces. Fixes attachment deletion when EMPTY_TRASH_DAYS is 0. Props c3mdigital, kurtpayne, SergeyBiryukov. fixes #21194 git-svn-id: http://core.svn.wordpress.org/trunk@21504 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/css/colors-classic.dev.css | 4 +++- wp-admin/css/colors-fresh.dev.css | 4 +++- wp-admin/edit-form-advanced.php | 2 +- wp-admin/includes/ajax-actions.php | 4 ++-- wp-admin/includes/class-wp-media-list-table.php | 10 +++++----- wp-admin/includes/class-wp-posts-list-table.php | 2 +- wp-admin/includes/media.php | 8 ++++---- wp-admin/post.php | 10 +++++----- wp-includes/link-template.php | 2 +- 9 files changed, 25 insertions(+), 21 deletions(-) diff --git a/wp-admin/css/colors-classic.dev.css b/wp-admin/css/colors-classic.dev.css index c76f5e1738..60b2b7fe36 100644 --- a/wp-admin/css/colors-classic.dev.css +++ b/wp-admin/css/colors-classic.dev.css @@ -516,7 +516,8 @@ div.dashboard-widget-submit input:hover, } .submitbox .submitdelete:hover, -#media-items a.delete:hover { +#media-items a.delete:hover, +#media-items a.delete-permanently:hover { color: #fff; background-color: #f00; border-bottom-color: #f00; @@ -607,6 +608,7 @@ a, #the-comment-list p.comment-author strong a, #media-upload a.del-link, #media-items a.delete, +#media-items a.delete-permanently, .plugins a.delete, .ui-tabs-nav a { color: #21759b; diff --git a/wp-admin/css/colors-fresh.dev.css b/wp-admin/css/colors-fresh.dev.css index 0719077e91..d86c019d87 100644 --- a/wp-admin/css/colors-fresh.dev.css +++ b/wp-admin/css/colors-fresh.dev.css @@ -507,7 +507,8 @@ div.dashboard-widget-submit input:hover, } .submitbox .submitdelete:hover, -#media-items a.delete:hover { +#media-items a.delete:hover, +#media-items a.delete-permanently:hover { color: #fff; background-color: #f00; border-bottom-color: #f00; @@ -598,6 +599,7 @@ a, #the-comment-list p.comment-author strong a, #media-upload a.del-link, #media-items a.delete, +#media-items a.delete-permanently, .plugins a.delete, .ui-tabs-nav a { color: #21759b; diff --git a/wp-admin/edit-form-advanced.php b/wp-admin/edit-form-advanced.php index 823a7a235d..8addfc9a83 100644 --- a/wp-admin/edit-form-advanced.php +++ b/wp-admin/edit-form-advanced.php @@ -83,7 +83,7 @@ if ( 'auto-draft' == $post->post_status ) { } $form_action = 'editpost'; -$nonce_action = 'update-' . $post_type . '_' . $post_ID; +$nonce_action = 'update-post_' . $post_ID; $form_extra .= ""; // Detect if there exists an autosave newer than the post and if that autosave is different than the post diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php index 439014d8cf..18849b8e65 100644 --- a/wp-admin/includes/ajax-actions.php +++ b/wp-admin/includes/ajax-actions.php @@ -1727,7 +1727,7 @@ function wp_ajax_wp_fullscreen_save_post() { elseif ( isset( $_POST['post_type'] ) && post_type_exists( $_POST['post_type'] ) ) $post_type = $_POST['post_type']; - check_ajax_referer('update-' . $post_type . '_' . $post_id, '_wpnonce'); + check_ajax_referer('update-post_' . $post_id, '_wpnonce'); $post_id = edit_post(); @@ -1769,7 +1769,7 @@ function wp_ajax_wp_remove_post_lock() { if ( ! $post = get_post( $post_id ) ) wp_die( 0 ); - check_ajax_referer( 'update-' . $post->post_type . '_' . $post_id ); + check_ajax_referer( 'update-post_' . $post_id ); if ( ! current_user_can( 'edit_post', $post_id ) ) wp_die( -1 ); diff --git a/wp-admin/includes/class-wp-media-list-table.php b/wp-admin/includes/class-wp-media-list-table.php index 29a272b521..2f959b8dd4 100644 --- a/wp-admin/includes/class-wp-media-list-table.php +++ b/wp-admin/includes/class-wp-media-list-table.php @@ -360,10 +360,10 @@ foreach ( $columns as $column_name => $column_display_name ) { $actions['edit'] = '' . __( 'Edit' ) . ''; if ( current_user_can( 'delete_post', $post->ID ) ) if ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) { - $actions['trash'] = "ID ) . "'>" . __( 'Trash' ) . ""; + $actions['trash'] = "ID ) . "'>" . __( 'Trash' ) . ""; } else { $delete_ays = !MEDIA_TRASH ? " onclick='return showNotice.warn();'" : ''; - $actions['delete'] = "ID ) . "'>" . __( 'Delete Permanently' ) . ""; + $actions['delete'] = "ID ) . "'>" . __( 'Delete Permanently' ) . ""; } $actions['view'] = '' . __( 'View' ) . ''; if ( current_user_can( 'edit_post', $post->ID ) ) @@ -374,12 +374,12 @@ foreach ( $columns as $column_name => $column_display_name ) { $actions['edit'] = '' . __( 'Edit' ) . ''; if ( current_user_can( 'delete_post', $post->ID ) ) { if ( $this->is_trash ) - $actions['untrash'] = "ID ) . "'>" . __( 'Restore' ) . ""; + $actions['untrash'] = "ID ) . "'>" . __( 'Restore' ) . ""; elseif ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) - $actions['trash'] = "ID ) . "'>" . __( 'Trash' ) . ""; + $actions['trash'] = "ID ) . "'>" . __( 'Trash' ) . ""; if ( $this->is_trash || !EMPTY_TRASH_DAYS || !MEDIA_TRASH ) { $delete_ays = ( !$this->is_trash && !MEDIA_TRASH ) ? " onclick='return showNotice.warn();'" : ''; - $actions['delete'] = "ID ) . "'>" . __( 'Delete Permanently' ) . ""; + $actions['delete'] = "ID ) . "'>" . __( 'Delete Permanently' ) . ""; } } if ( !$this->is_trash ) { diff --git a/wp-admin/includes/class-wp-posts-list-table.php b/wp-admin/includes/class-wp-posts-list-table.php index 9d509bb794..e3d2ac76e4 100644 --- a/wp-admin/includes/class-wp-posts-list-table.php +++ b/wp-admin/includes/class-wp-posts-list-table.php @@ -545,7 +545,7 @@ class WP_Posts_List_Table extends WP_List_Table { } if ( current_user_can( $post_type_object->cap->delete_post, $post->ID ) ) { if ( 'trash' == $post->post_status ) - $actions['untrash'] = "ID ) ), 'untrash-' . $post->post_type . '_' . $post->ID ) . "'>" . __( 'Restore' ) . ""; + $actions['untrash'] = "ID ) ), 'untrash-post_' . $post->ID ) . "'>" . __( 'Restore' ) . ""; elseif ( EMPTY_TRASH_DAYS ) $actions['trash'] = "" . __( 'Trash' ) . ""; if ( 'trash' == $post->post_status || !EMPTY_TRASH_DAYS ) diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php index 51a8876b00..a5f5f2ac5b 100644 --- a/wp-admin/includes/media.php +++ b/wp-admin/includes/media.php @@ -1156,16 +1156,16 @@ function get_media_item( $attachment_id, $args = null ) { $send = get_submit_button( __( 'Insert into Post' ), 'button', "send[$attachment_id]", false ); if ( $delete && current_user_can( 'delete_post', $attachment_id ) ) { if ( !EMPTY_TRASH_DAYS ) { - $delete = "" . __( 'Delete Permanently' ) . ''; + $delete = "" . __( 'Delete Permanently' ) . ''; } elseif ( !MEDIA_TRASH ) { $delete = "" . __( 'Delete' ) . " "; } else { - $delete = "" . __( 'Move to Trash' ) . " - "; + $delete = "" . __( 'Move to Trash' ) . " + "; } } else { $delete = ''; diff --git a/wp-admin/post.php b/wp-admin/post.php index 035a185540..2c5ecb20be 100644 --- a/wp-admin/post.php +++ b/wp-admin/post.php @@ -177,7 +177,7 @@ case 'edit': break; case 'editattachment': - check_admin_referer('update-attachment_' . $post_id); + check_admin_referer('update-post_' . $post_id); // Don't let these be changed unset($_POST['guid']); @@ -190,7 +190,7 @@ case 'editattachment': wp_update_attachment_metadata( $post_id, $newmeta ); case 'editpost': - check_admin_referer('update-' . $post_type . '_' . $post_id); + check_admin_referer('update-post_' . $post_id); $post_id = edit_post(); @@ -200,7 +200,7 @@ case 'editpost': break; case 'trash': - check_admin_referer('trash-' . $post_type . '_' . $post_id); + check_admin_referer('trash-post_' . $post_id); $post = & get_post($post_id); @@ -215,7 +215,7 @@ case 'trash': break; case 'untrash': - check_admin_referer('untrash-' . $post_type . '_' . $post_id); + check_admin_referer('untrash-post_' . $post_id); if ( !current_user_can($post_type_object->cap->delete_post, $post_id) ) wp_die( __('You are not allowed to move this item out of the Trash.') ); @@ -228,7 +228,7 @@ case 'untrash': break; case 'delete': - check_admin_referer('delete-' . $post_type . '_' . $post_id); + check_admin_referer('delete-post_' . $post_id); if ( !current_user_can($post_type_object->cap->delete_post, $post_id) ) wp_die( __('You are not allowed to delete this item.') ); diff --git a/wp-includes/link-template.php b/wp-includes/link-template.php index 8097a657cb..30e1499426 100644 --- a/wp-includes/link-template.php +++ b/wp-includes/link-template.php @@ -971,7 +971,7 @@ function get_delete_post_link( $id = 0, $deprecated = '', $force_delete = false $delete_link = add_query_arg( 'action', $action, admin_url( sprintf( $post_type_object->_edit_link, $post->ID ) ) ); - return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-{$post->post_type}_{$post->ID}" ), $post->ID, $force_delete ); + return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-post_{$post->ID}" ), $post->ID, $force_delete ); } /**