Ticket #24131: 24131-2.patch

wp-admin/includes/post.php

@@ -1212 +1212 @@
         <?php
 
         if ( $locked ) {
-                $preview_link = set_url_scheme( add_query_arg( 'preview', 'true', get_permalink( $post->ID ) ) );
+                $preview_args = array( 'preview' => 'true' );
 
-                if ( 'publish' == $post->post_status || $user->ID != $post->post_author ) {
-                        // Latest content is in autosave
-                        $nonce = wp_create_nonce( 'post_preview_' . $post->ID );
-                        $preview_link = add_query_arg( array( 'preview_id' => $post->ID, 'preview_nonce' => $nonce ), $preview_link );
-                }
+                if ( 'publish' == $post->post_status || $user->ID != $post->post_author ) // Latest content is in autosave
+                        $preview_args['latest_changes'] = 'true';
 
-                $preview_link = apply_filters( 'preview_post_link', $preview_link );
+                $preview_link = apply_filters( 'preview_post_link', add_query_arg( $preview_args, get_permalink( $post->ID ) ) );
                 $override = apply_filters( 'override_post_lock', true, $post, $user );
                 $tab_last = $override ? '' : ' wp-tab-last';
 
@@ -1366 +1363 @@
         }
 
         $user_id = get_current_user_id();
+        $query_args = array( 'preview' => 'true' );
+
         if ( 'draft' == $post->post_status && $user_id == $post->post_author ) {
                 $id = edit_post();
         } else { // Non drafts are not overwritten. The autosave is stored in a special post revision.
                 $id = wp_create_post_autosave( $post->ID );
-                if ( ! is_wp_error($id) )
+                if ( ! is_wp_error($id) ) {
                         $id = $post->ID;
+                        $query_args['latest_changes'] = 'true';
+                }
         }
 
         if ( is_wp_error($id) )
                 wp_die( $id->get_error_message() );
 
-        if ( $_POST['post_status'] == 'draft' && $user_id == $post->post_author ) {
-                $url = add_query_arg( 'preview', 'true', get_permalink($id) );
-        } else {
-                $nonce = wp_create_nonce('post_preview_' . $id);
-                $url = add_query_arg( array( 'preview' => 'true', 'preview_id' => $id, 'preview_nonce' => $nonce ), get_permalink($id) );
-        }
-
-        return apply_filters( 'preview_post_link', $url );
+        return apply_filters( 'preview_post_link', add_query_arg( $query_args, get_permalink($id) ) );
 }

wp-includes/default-filters.php

@@ -277 +277 @@
 add_action( 'template_redirect', 'wp_old_slug_redirect'              );
 add_action( 'post_updated',      'wp_check_for_changed_slugs', 12, 3 );
 
-// Nonce check for Post Previews
-add_action( 'init', '_show_post_preview' );
+// Post Previews
+add_filter( 'the_preview', '_set_preview' );
+add_filter( 'preview_post_link', '_wp_add_preview_nonce', 5 );
 
 // Timezone
 add_filter( 'pre_option_gmt_offset','wp_timezone_override_offset' );

wp-includes/query.php

@@ -2732 +2732 @@
                                 }
                         }
 
-                        if ( $this->is_preview && $this->posts && current_user_can( $edit_cap, $this->posts[0]->ID ) )
-                                $this->posts[0] = get_post( apply_filters_ref_array( 'the_preview', array( $this->posts[0], &$this ) ) );
+                        if ( $this->is_preview && $this->posts && current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
+                                if ( $the_preview = apply_filters( 'the_preview', $this->posts[0], $this ) )
+                                        $this->posts[0] = get_post( $the_preview );
+                                else
+                                        $this->posts = array();
+                        }
                 }
 
                 // Put sticky posts at the top of the posts array

wp-includes/revision.php

@@ -496 +496 @@
         return (int) apply_filters( 'wp_revisions_to_keep', $num, $post );
 }
 
-function _set_preview($post) {
+/**
+ * Check the nonce for preview links. Overload the content
+ * wiht the latest autosave when 'latest_changes' is set.
+ *
+ * @access private
+ */
+function _set_preview( $post ) {
+        // Don't show a preview if the user is not coming from a 'preview' link in the admin
+        if ( empty( $_GET['preview_nonce'] ) || ! wp_verify_nonce( $_GET['preview_nonce'], 'post-preview' ) )
+                return false;
 
-        if ( ! is_object($post) )
-                return $post;
+        if ( isset($_GET['latest_changes']) ) {
+                if ( ! is_object($post) )
+                        return $post;
 
-        $preview = wp_get_post_autosave($post->ID);
+                $preview = wp_get_post_autosave( $post->ID );
 
-        if ( ! is_object($preview) )
-                return $post;
+                if ( ! is_object($preview) )
+                        return $post;
 
-        $preview = sanitize_post($preview);
+                $preview = sanitize_post($preview);
 
-        $post->post_content = $preview->post_content;
-        $post->post_title = $preview->post_title;
-        $post->post_excerpt = $preview->post_excerpt;
+                $post->post_content = $preview->post_content;
+                $post->post_title = $preview->post_title;
+                $post->post_excerpt = $preview->post_excerpt;
 
-        add_filter( 'get_post_metadata', '_wp_preview_meta_filter', 10, 4 );
-        add_filter( 'get_the_terms', '_wp_preview_terms_filter', 10, 3 );
+                add_filter( 'get_post_metadata', '_wp_preview_meta_filter', 10, 4 );
+                add_filter( 'get_the_terms', '_wp_preview_terms_filter', 10, 3 );
+        }
 
         return $post;
 }
 
-function _show_post_preview() {
-
-        if ( isset($_GET['preview_id']) && isset($_GET['preview_nonce']) ) {
-                $id = (int) $_GET['preview_id'];
-
-                if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $id ) )
-                        wp_die( __('You do not have permission to preview drafts.') );
-
-                add_filter('the_preview', '_set_preview');
-        }
-}
-
 /**
  * Filters post meta retrieval to get values from the actual autosave post,
  * and not its parent. Filters revisioned meta keys only.
@@ -573 +572 @@
         return $terms;
 }
 
+/**
+ * Add a nonce to all preview links.
+ *
+ * @since 3.6.0
+ * @access private
+ */
+function _wp_add_preview_nonce( $url )  {
+        static $nonce;
+
+        if ( ! $nonce )
+                $nonce = wp_create_nonce('post-preview');
+
+        return add_query_arg( 'preview_nonce', $nonce, $url );
+}
+
 function _wp_get_post_revision_version( $revision ) {
         if ( is_object( $revision ) )
                 $revision = get_object_vars( $revision );