JS autosave_update_slug() doesn't check if return is -1
|Reported by:||nacin||Owned by:|
If check_ajax_referer() fails, it'll die with -1. In autosave_update_slug(), we don't account for that, which results in a goofy -1 in the HTML.
See the example here: http://cl.ly/0Q341X010Z0c2H3s1R1I. Probably the most common reason for the check to fail would be if the user has since logged out, as you can see in the bottom right corner of the screenshot. I often see this when I discover tabs that I opened days before.