Ticket #23165: 23165-incrementing-id.diff

src/wp-includes/functions.php

@@ -1773 +1773 @@
  * @return string Nonce field HTML markup.
  */
 function wp_nonce_field( $action = -1, $name = '_wpnonce', $referer = true, $echo = true ) {
+        global $wp_nonce_field_ids;
+        if ( ! isset( $wp_nonce_field_ids ) ) {
+                $wp_nonce_field_ids = array();
+        }
+
+        /*
+         * To avoid conflicting HTML IDs, a unique `$name` is recommended. Track a
+         * global incrementing count for reused names as a fallback precaution, to
+         * assure that a unique ID is assigned.
+         */
+        $id = $name;
+        if ( isset( $wp_nonce_field_ids[ $id ] ) ) {
+                $id .= '-' . ++$wp_nonce_field_ids[ $id ];
+        } else {
+                $wp_nonce_field_ids[ $id ] = 1;
+        }
+
         $name        = esc_attr( $name );
         $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
 

tests/phpunit/includes/abstract-testcase.php

@@ -177 +177 @@
                 $_GET  = array();
                 $_POST = array();
                 self::flush_cache();
+
+                global $wp_nonce_field_ids;
+                unset( $wp_nonce_field_ids );
         }
 
         /**

tests/phpunit/tests/functions.php

@@ -1678 +1678 @@
                         array( '03:61:59', false ), // Out of bound.
                 );
         }
+
+        function test_wp_nonce_field_unique_ids() {
+                $field_one = wp_nonce_field( 'my-action', 'my-name', true, false );
+                $field_two = wp_nonce_field( 'my-action', 'my-name', true, false );
+
+                $this->assertStringMatchesFormat( '<input type="hidden" id="my-name" name="my-name" value="%s" />', $field_one );
+                $this->assertStringMatchesFormat( '<input type="hidden" id="my-name-2" name="my-name" value="%s" />', $field_two );
+        }
+
 }