Ticket #16483: 16483.8.diff

src/wp-includes/post-template.php

@@ -788 +788 @@
                 return apply_filters( 'post_password_required', false, $post );
         }
 
-        if ( ! isset( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] ) ) {
+        $cookie = "wp-postpass_{$post->ID}_" . COOKIEHASH;
+
+        /**
+         * Filters the name of the cookie checked for password protected posts.
+         *
+         * @since 4.7.0
+         *
+         * @param string $cookie Default cookie name.
+         */
+        $cookie = apply_filters( 'post_password_cookie', $cookie );
+
+        if ( ! isset( $_COOKIE[$cookie] ) ) {
                 /** This filter is documented in wp-includes/post.php */
                 return apply_filters( 'post_password_required', true, $post );
         }
@@ -795 +806 @@
 
         $hasher = new PasswordHash( 8, true );
 
-        $hash = wp_unslash( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
+        $hash = wp_unslash( $_COOKIE[$cookie] );
+
         if ( 0 !== strpos( $hash, '$P$B' ) ) {
                 $required = true;
         } else {
@@ -1596 +1608 @@
  */
 function get_the_password_form( $post = 0 ) {
         $post = get_post( $post );
-        $label = 'pwbox-' . ( empty($post->ID) ? rand() : $post->ID );
+        $post_id = empty( $post->ID ) ? rand() : $post->ID;
+        $label = 'pwbox-' . $post_id;
         $output = '<form action="' . esc_url( site_url( 'wp-login.php?action=postpass', 'login_post' ) ) . '" class="post-password-form" method="post">
         <p>' . __( 'This content is password protected. To view it please enter your password below:' ) . '</p>
-        <p><label for="' . $label . '">' . __( 'Password:' ) . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr_x( 'Enter', 'post password form' ) . '" /></p></form>
+        <p><label for="' . $label . '">' . __( 'Password:' ) . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="hidden" name="post_id" value="' . $post_id . '" /> <input type="submit" name="Submit" value="' . esc_attr_x( 'Enter', 'post password form' ) . '" /></p></form>
         ';
 
         /**

src/wp-login.php

@@ -454 +454 @@
         } else {
                 $secure = false;
         }
-        setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
+        
+        /** This filter is documented in wp-includes/post-template.php */
+        $cookie = apply_filters( 'post_password_cookie', "wp-postpass_{$_POST['post_id']}_" . COOKIEHASH );
+        setcookie( $cookie, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
 
         wp_safe_redirect( wp_get_referer() );
         exit();