Ticket #16483: 16483.2.diff

wp-includes/post-template.php

@@ -553 +553 @@
 
         if ( empty($post->post_password) )
                 return false;
+                
+        $name = "wp-postpass_{$post->ID}" . COOKIEHASH;
 
-        if ( !isset($_COOKIE['wp-postpass_' . COOKIEHASH]) )
-                return true;
-
-        if ( $_COOKIE['wp-postpass_' . COOKIEHASH] != $post->post_password )
+        if ( !isset($_COOKIE[$name]) || $_COOKIE[$name] != $post->post_password )
                 return true;
 
         return false;
@@ -1204 +1203 @@
  * @since 1.0.0
  * @uses apply_filters() Calls 'the_password_form' filter on output.
  *
+ * @param int ID of the post. Optional, fall back to the current post in the loop.
  * @return string HTML content for password form for password protected post.
  */
-function get_the_password_form() {
-        global $post;
-        $label = 'pwbox-'.(empty($post->ID) ? rand() : $post->ID);
+function get_the_password_form( $id = null ) {
+        if ( ! $id ) {
+                global $post;
+                $id = empty( $post->ID ) ? rand() : $post->ID;
+        }
+        
+        $label = 'pwbox-' . $id;
         $output = '<form action="' . get_option('siteurl') . '/wp-pass.php" method="post">
         <p>' . __("This post is password protected. To view it please enter your password below:") . '</p>
-        <p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>
+        <p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" />
+        <input type="hidden" name="id" value="' . $id . '" /></p>
         </form>
         ';
         return apply_filters('the_password_form', $output);

wp-includes/theme-compat/comments-popup.php

@@ -45 +45 @@
 $comments = get_approved_comments($id);
 $post = get_post($id);
 if ( post_password_required($post) ) {  // and it doesn't match the cookie
-        echo(get_the_password_form());
+        echo(get_the_password_form( $id ));
 } else { ?>
 
 <?php if ($comments) { ?>

wp-pass.php

@@ -13 +13 @@
         $_POST['post_password'] = stripslashes($_POST['post_password']);
 
 // 10 days
-setcookie('wp-postpass_' . COOKIEHASH, $_POST['post_password'], time() + 864000, COOKIEPATH);
+setcookie('wp-postpass_' . $_POST['id'] . COOKIEHASH, $_POST['post_password'], time() + 864000, COOKIEPATH);
 
 wp_safe_redirect(wp_get_referer());
 exit;