Ticket #16483: 16483.diff

wp-pass.php

@@ -11 +11 @@
 
 if ( get_magic_quotes_gpc() )
         $_POST['post_password'] = stripslashes($_POST['post_password']);
+        
+$postid = (int) $_POST['post_ID'];
 
 // 10 days
-setcookie('wp-postpass_' . COOKIEHASH, $_POST['post_password'], time() + 864000, COOKIEPATH);
+setcookie("wp-postpass_{$postid}_" . COOKIEHASH, $_POST['post_password'], time() + 864000, COOKIEPATH);
 
 wp_safe_redirect(wp_get_referer());
 exit;

wp-includes/post-template.php

@@ -554 +554 @@
         if ( empty($post->post_password) )
                 return false;
 
-        if ( !isset($_COOKIE['wp-postpass_' . COOKIEHASH]) )
+        if ( !isset($_COOKIE["wp-postpass_{$post->ID}_" . COOKIEHASH]) )
                 return true;
 
-        if ( $_COOKIE['wp-postpass_' . COOKIEHASH] != $post->post_password )
+        if ( $_COOKIE["wp-postpass_{$post->ID}_" . COOKIEHASH] != $post->post_password )
                 return true;
 
         return false;
@@ -1204 +1204 @@
  * @since 1.0.0
  * @uses apply_filters() Calls 'the_password_form' filter on output.
  *
+ * @param int|object $post An optional post.  Global $post used if not provided.
  * @return string HTML content for password form for password protected post.
  */
-function get_the_password_form() {
-        global $post;
-        $label = 'pwbox-'.(empty($post->ID) ? rand() : $post->ID);
-        $output = '<form action="' . get_option('siteurl') . '/wp-pass.php" method="post">
-        <p>' . __("This post is password protected. To view it please enter your password below:") . '</p>
-        <p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>
-        </form>
-        ';
+function get_the_password_form( $post = null ) {
+        $post = get_post( $post );
+
+        $label = 'pwbox-' . $post->ID;
+        $output = '<form action="' . get_option('siteurl') . '/wp-pass.php" method="post">';
+        $output .=      '<p>' . __('This post is password protected. To view it please enter your password below:') . '</p>';
+        $output .= "<p><label for='$label'>" . __('Password:') . " <input name='post_password' id='$label' type='password' size='20' /></label> <input type='hidden' name='post_ID' value='$post->ID' /> <input type='submit' name='Submit' value='" . esc_attr__('Submit') . "' /></p>";
+        $output .= '</form>';
+        
         return apply_filters('the_password_form', $output);
 }