Ticket #19730: 19730.patch

wp-admin/includes/class-wp-media-list-table.php

@@ -354 +354 @@
         function _get_row_actions( $post, $att_title ) {
                 $actions = array();
 
+                $referer = urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) );
+
                 if ( $this->detached ) {
                         if ( current_user_can( 'edit_post', $post->ID ) )
                                 $actions['edit'] = '<a href="' . get_edit_post_link( $post->ID, true ) . '">' . __( 'Edit' ) . '</a>';
                         if ( current_user_can( 'delete_post', $post->ID ) )
                                 if ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) {
-                                        $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
+                                        $nonce_url = wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID );
+                                        $submit_url = esc_url( admin_url( add_query_arg( '_wp_http_referer', $referer, $nonce_url ) ) );
+                                        $actions['trash'] = "<a class='submitdelete' href='$submit_url'>" . __( 'Trash' ) . "</a>";
                                 } else {
                                         $delete_ays = !MEDIA_TRASH ? " onclick='return showNotice.warn();'" : '';
-                                        $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
+                                        $nonce_url = wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID );
+                                        $submit_url = esc_url( admin_url( add_query_arg( '_wp_http_referer', $referer, $nonce_url ) ) );
+                                        $actions['delete'] = "<a class='submitdelete'$delete_ays href='$submit_url'>" . __( 'Delete Permanently' ) . "</a>";
                                 }
                         $actions['view'] = '<a href="' . get_permalink( $post->ID ) . '" title="' . esc_attr( sprintf( __( 'View &#8220;%s&#8221;' ), $att_title ) ) . '" rel="permalink">' . __( 'View' ) . '</a>';
                         if ( current_user_can( 'edit_post', $post->ID ) )
@@ -372 +378 @@
                         if ( current_user_can( 'edit_post', $post->ID ) && !$this->is_trash )
                                 $actions['edit'] = '<a href="' . get_edit_post_link( $post->ID, true ) . '">' . __( 'Edit' ) . '</a>';
                         if ( current_user_can( 'delete_post', $post->ID ) ) {
-                                if ( $this->is_trash )
-                                        $actions['untrash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-attachment_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";
-                                elseif ( EMPTY_TRASH_DAYS && MEDIA_TRASH )
-                                        $actions['trash'] = "<a class='submitdelete' href='" . wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID ) . "'>" . __( 'Trash' ) . "</a>";
+                                if ( $this->is_trash ) {
+                                        $nonce_url = wp_nonce_url( "post.php?action=untrash&amp;post=$post->ID", 'untrash-attachment_' . $post->ID );
+                                        $submit_url = esc_url( admin_url( add_query_arg( '_wp_http_referer', $referer, $nonce_url ) ) );
+                                        $actions['untrash'] = "<a class='submitdelete' href='$submit_url'>" . __( 'Restore' ) . "</a>";
+                                } elseif ( EMPTY_TRASH_DAYS && MEDIA_TRASH ) {
+                                        $nonce_url = wp_nonce_url( "post.php?action=trash&amp;post=$post->ID", 'trash-attachment_' . $post->ID );
+                                        $submit_url = esc_url( admin_url( add_query_arg( '_wp_http_referer', $referer, $nonce_url ) ) );
+                                        $actions['trash'] = "<a class='submitdelete' href='$submit_url'>" . __( 'Trash' ) . "</a>";
+                                }
                                 if ( $this->is_trash || !EMPTY_TRASH_DAYS || !MEDIA_TRASH ) {
                                         $delete_ays = ( !$this->is_trash && !MEDIA_TRASH ) ? " onclick='return showNotice.warn();'" : '';
-                                        $actions['delete'] = "<a class='submitdelete'$delete_ays href='" . wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID ) . "'>" . __( 'Delete Permanently' ) . "</a>";
+                                        $nonce_url = wp_nonce_url( "post.php?action=delete&amp;post=$post->ID", 'delete-attachment_' . $post->ID );
+                                        $submit_url = esc_url( admin_url( add_query_arg( '_wp_http_referer', $referer, $nonce_url ) ) );
+                                        $actions['delete'] = "<a class='submitdelete'$delete_ays href='$submit_url'>" . __( 'Delete Permanently' ) . "</a>";
                                 }
                         }
                         if ( !$this->is_trash ) {