Changeset 21504

Timestamp:

08/14/2012 06:39:15 PM (12 years ago)

Author:

ryan

Message:

Remove post type from post nonces. Fixes attachment deletion when EMPTY_TRASH_DAYS is 0. Props c3mdigital, kurtpayne, SergeyBiryukov. fixes #21194

Location:

trunk

Files:

• wp-admin/css/colors-classic.dev.css (modified) (2 diffs)
• wp-admin/css/colors-fresh.dev.css (modified) (2 diffs)
• wp-admin/edit-form-advanced.php (modified) (1 diff)
• wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• wp-admin/includes/class-wp-media-list-table.php (modified) (2 diffs)
• wp-admin/includes/class-wp-posts-list-table.php (modified) (1 diff)
• wp-admin/includes/media.php (modified) (1 diff)
• wp-admin/post.php (modified) (5 diffs)
• wp-includes/link-template.php (modified) (1 diff)

trunk/wp-admin/css/colors-classic.dev.css

@@ -517 +517 @@
 
 .submitbox .submitdelete:hover,
-#media-items a.delete:hover {
+#media-items a.delete:hover,
+#media-items a.delete-permanently:hover {
     color: #fff;
     background-color: #f00;
@@ -608 +609 @@
 #media-upload a.del-link,
 #media-items a.delete,
+
 .plugins a.delete,
 .ui-tabs-nav a {

trunk/wp-admin/css/colors-fresh.dev.css

@@ -508 +508 @@
 
 .submitbox .submitdelete:hover,
-#media-items a.delete:hover {
+#media-items a.delete:hover,
+#media-items a.delete-permanently:hover {
     color: #fff;
     background-color: #f00;
@@ -599 +600 @@
 #media-upload a.del-link,
 #media-items a.delete,
+
 .plugins a.delete,
 .ui-tabs-nav a {

trunk/wp-admin/edit-form-advanced.php

@@ -84 +84 @@
 
 $form_action = 'editpost';
-$nonce_action = 'update-' . $post_type . '_' . $post_ID;
+$nonce_action = 'update-_' . $post_ID;
 $form_extra .= "<input type='hidden' id='post_ID' name='post_ID' value='" . esc_attr($post_ID) . "' />";
 

trunk/wp-admin/includes/ajax-actions.php

@@ -1728 +1728 @@
         $post_type = $_POST['post_type'];
 
-    check_ajax_referer('update-' . $post_type . '_' . $post_id, '_wpnonce');
+    check_ajax_referer('update-_' . $post_id, '_wpnonce');
 
     $post_id = edit_post();
@@ -1770 +1770 @@
         wp_die( 0 );
 
-    check_ajax_referer( 'update-' . $post->post_type . '_' . $post_id );
+    check_ajax_referer( 'update-_' . $post_id );
 
     if ( ! current_user_can( 'edit_post', $post_id ) )

trunk/wp-admin/includes/class-wp-media-list-table.php

@@ -361 +361 @@
             if ( current_user_can( 'delete_post', $post->ID ) )
                 if ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) {
-                    $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
+                    $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-t_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
                 } else {
                     $delete_ays = !MEDIA_TRASH ? " onclick='return showNotice.warn();'" : '';
-                    $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
+                    $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-t_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
                 }
             $actions['view'] = '<a href="' . get_permalink( $post->ID ) . '" title="' . esc_attr( sprintf( __( 'View &#8220;%s&#8221;' ), $att_title ) ) . '" rel="permalink">' . __( 'View' ) . '</a>';
@@ -375 +375 @@
             if ( current_user_can( 'delete_post', $post->ID ) ) {
                 if ( $this->is_trash )
-                    $actions['untrash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-attachment_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
+                    $actions['untrash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-t_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
                 elseif ( EMPTY_TRASH_DAYS && MEDIA_TRASH )
-                    $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
+                    $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-t_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
                 if ( $this->is_trash || !EMPTY_TRASH_DAYS || !MEDIA_TRASH ) {
                     $delete_ays = ( !$this->is_trash && !MEDIA_TRASH ) ? " onclick='return showNotice.warn();'" : '';
-                    $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
+                    $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-t_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
                 }
             }

trunk/wp-admin/includes/class-wp-posts-list-table.php

@@ -546 +546 @@
                 if ( current_user_can( $post_type_object->cap->delete_post, $post->ID ) ) {
                     if ( 'trash' == $post->post_status )
-                        $actions['untrash'] = "<a title='" . esc_attr( __( 'Restore this item from the Trash' ) ) . "' href='" . wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $post->ID ) ), 'untrash-' . $post->post_type . '_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
+                        $actions['untrash'] = "<a title='" . esc_attr( __( 'Restore this item from the Trash' ) ) . "' href='" . wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $post->ID ) ), 'untrash-_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
                     elseif ( EMPTY_TRASH_DAYS )
                         $actions['trash'] = "<a class='submitdelete' title='" . esc_attr( __( 'Move this item to the Trash' ) ) . "' href='" . get_delete_post_link( $post->ID ) . "'>" . __( 'Trash' ) . "</a>";

trunk/wp-admin/includes/media.php

@@ -1157 +1157 @@
     if ( $delete && current_user_can( 'delete_post', $attachment_id ) ) {
         if ( !EMPTY_TRASH_DAYS ) {
-            $delete = "<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Delete Permanently' ) . '</a>';
+            $delete = "<a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-'>" . __( 'Delete Permanently' ) . '</a>';
         } elseif ( !MEDIA_TRASH ) {
             $delete = "<a href='#' class='del-link' onclick=\"document.getElementById('del_attachment_$attachment_id').style.display='block';return false;\">" . __( 'Delete' ) . "</a>
              <div id='del_attachment_$attachment_id' class='del-attachment' style='display:none;'><p>" . sprintf( __( 'You are about to delete <strong>%s</strong>.' ), $filename ) . "</p>
-             <a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='button'>" . __( 'Continue' ) . "</a>
+             <a href='" . wp_nonce_url( "post.php?action=delete&amp;post=$attachment_id", 'delete-t_' . $attachment_id ) . "' id='del[$attachment_id]' class='button'>" . __( 'Continue' ) . "</a>
              <a href='#' class='button' onclick=\"this.parentNode.style.display='none';return false;\">" . __( 'Cancel' ) . "</a>
              </div>";
         } else {
-            $delete = "<a href='" . wp_nonce_url( "post.php?action=trash&amp;post=$attachment_id", 'trash-attachment_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Move to Trash' ) . "</a>
-            <a href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$attachment_id", 'untrash-attachment_' . $attachment_id ) . "' id='undo[$attachment_id]' class='undo hidden'>" . __( 'Undo' ) . "</a>";
+            $delete = "<a href='" . wp_nonce_url( "post.php?action=trash&amp;post=$attachment_id", 'trash-t_' . $attachment_id ) . "' id='del[$attachment_id]' class='delete'>" . __( 'Move to Trash' ) . "</a>
+            <a href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$attachment_id", 'untrash-t_' . $attachment_id ) . "' id='undo[$attachment_id]' class='undo hidden'>" . __( 'Undo' ) . "</a>";
         }
     } else {

trunk/wp-admin/post.php

@@ -178 +178 @@
 
 case 'editattachment':
-    check_admin_referer('update-attachment_' . $post_id);
+    check_admin_referer('update-t_' . $post_id);
 
     // Don't let these be changed
@@ -191 +191 @@
 
 case 'editpost':
-    check_admin_referer('update-' . $post_type . '_' . $post_id);
+    check_admin_referer('update-_' . $post_id);
 
     $post_id = edit_post();
@@ -201 +201 @@
 
 case 'trash':
-    check_admin_referer('trash-' . $post_type . '_' . $post_id);
+    check_admin_referer('trash-_' . $post_id);
 
     $post = & get_post($post_id);
@@ -216 +216 @@
 
 case 'untrash':
-    check_admin_referer('untrash-' . $post_type . '_' . $post_id);
+    check_admin_referer('untrash-_' . $post_id);
 
     if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
@@ -229 +229 @@
 
 case 'delete':
-    check_admin_referer('delete-' . $post_type . '_' . $post_id);
+    check_admin_referer('delete-_' . $post_id);
 
     if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )

trunk/wp-includes/link-template.php

@@ -972 +972 @@
     $delete_link = add_query_arg( 'action', $action, admin_url( sprintf( $post_type_object->_edit_link, $post->ID ) ) );
 
-    return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-{$post->post_type}_{$post->ID}" ), $post->ID, $force_delete );
+    return apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-_{$post->ID}" ), $post->ID, $force_delete );
 }