Ticket #16483: 16483.5.diff

wp-includes/post-template.php

@@ -574 +574 @@
         if ( empty( $post->post_password ) )
                 return false;
 
-        if ( ! isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
+        if ( ! isset( $_COOKIE[ "wp-postpass_{$post->ID}_" . COOKIEHASH ] ) )
                 return true;
 
         if ( empty( $wp_hasher ) ) {
@@ -583 +583 @@
                 $wp_hasher = new PasswordHash(8, true);
         }
 
-        $hash = stripslashes( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
+        $hash = stripslashes( $_COOKIE[ "wp-postpass_{$post->ID}_" . COOKIEHASH ] );
 
         return ! $wp_hasher->CheckPassword( $post->post_password, $hash );
 }
@@ -1217 +1217 @@
  * @since 1.0.0
  * @uses apply_filters() Calls 'the_password_form' filter on output.
  *
+ * @param int|object $post An optional post. Global $post used if not provided.
  * @return string HTML content for password form for password protected post.
  */
-function get_the_password_form() {
-        $post = get_post();
-        $label = 'pwbox-' . ( empty($post->ID) ? rand() : $post->ID );
+function get_the_password_form( $post = null ) {
+        $post = get_post( $post );
+        $post_id = empty( $post->ID ) ? rand() : $post->ID;
+        $label = 'pwbox-' . $post_id;
         $output = '<form action="' . esc_url( site_url( 'wp-login.php?action=postpass', 'login_post' ) ) . '" method="post">
         <p>' . __("This post is password protected. To view it please enter your password below:") . '</p>
         <p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>
+        <input type="hidden" name="post_id" value="' . $post_id . '" />
 </form>
         ';
         return apply_filters('the_password_form', $output);

wp-includes/theme-compat/comments-popup.php

@@ -45 +45 @@
 $comments = get_approved_comments($id);
 $post = get_post($id);
 if ( post_password_required($post) ) {  // and it doesn't match the cookie
-        echo(get_the_password_form());
+        echo get_the_password_form($post);
 } else { ?>
 
 <?php if ($comments) { ?>

wp-login.php

@@ -399 +399 @@
         }
 
         // 10 days
-        setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
+        setcookie( "wp-postpass_{$_POST['post_id']}_" . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
 
         wp_safe_redirect( wp_get_referer() );
         exit();