Ticket #24131: 24131.patch

wp-admin/includes/post.php

@@ -1361 +1361 @@
         }
 
         $user_id = get_current_user_id();
+        $query_args = array( 'preview' => 'true' );
+
         if ( 'draft' == $post->post_status && $user_id == $post->post_author ) {
                 $id = edit_post();
         } else { // Non drafts are not overwritten. The autosave is stored in a special post revision.
                 $id = wp_create_post_autosave( $post->ID );
-                if ( ! is_wp_error($id) )
+                if ( ! is_wp_error($id) ) {
                         $id = $post->ID;
+                        $query_args['latest_changes'] = 'true';
+                }
         }
 
         if ( is_wp_error($id) )
                 wp_die( $id->get_error_message() );
 
-        if ( $_POST['post_status'] == 'draft' && $user_id == $post->post_author ) {
-                $url = add_query_arg( 'preview', 'true', get_permalink($id) );
-        } else {
-                $nonce = wp_create_nonce('post_preview_' . $id);
-                $url = add_query_arg( array( 'preview' => 'true', 'preview_id' => $id, 'preview_nonce' => $nonce ), get_permalink($id) );
-        }
-
-        return apply_filters( 'preview_post_link', $url );
+        return apply_filters( 'preview_post_link', add_query_arg( $query_args, get_permalink($id) ) );
 }

wp-includes/default-filters.php

@@ -275 +275 @@
 add_action( 'template_redirect', 'wp_old_slug_redirect'              );
 add_action( 'post_updated',      'wp_check_for_changed_slugs', 12, 3 );
 
-// Nonce check for Post Previews
-add_action( 'init', '_show_post_preview' );
+// Post Previews
+add_filter('the_preview', '_set_preview');
 
 // Timezone
 add_filter( 'pre_option_gmt_offset','wp_timezone_override_offset' );

wp-includes/revision.php

@@ -496 +496 @@
         return (int) apply_filters( 'wp_revisions_to_keep', $num, $post );
 }
 
-function _set_preview($post) {
+function _set_preview( $post ) {
+        if ( isset($_GET['latest_changes']) ) {
+                if ( ! is_object($post) )
+                        return $post;
 
-        if ( ! is_object($post) )
-                return $post;
+                $preview = wp_get_post_autosave($post->ID);
 
-        $preview = wp_get_post_autosave($post->ID);
+                if ( ! is_object($preview) )
+                        return $post;
 
-        if ( ! is_object($preview) )
-                return $post;
+                // Show the latest changes only to the author when post_status != publish
+                if ( $post->post_status == 'publish' || $preview->post_author == get_current_user_id() ) {
+                        $preview = sanitize_post($preview);
 
-        $preview = sanitize_post($preview);
+                        $post->post_content = $preview->post_content;
+                        $post->post_title = $preview->post_title;
+                        $post->post_excerpt = $preview->post_excerpt;
 
-        $post->post_content = $preview->post_content;
-        $post->post_title = $preview->post_title;
-        $post->post_excerpt = $preview->post_excerpt;
+                        add_filter( 'get_post_metadata', '_wp_preview_meta_filter', 10, 4 );
+                        add_filter( 'get_the_terms', '_wp_preview_terms_filter', 10, 3 );
+                }
+        }
 
-        add_filter( 'get_post_metadata', '_wp_preview_meta_filter', 10, 4 );
-        add_filter( 'get_the_terms', '_wp_preview_terms_filter', 10, 3 );
-
         return $post;
 }
 
-function _show_post_preview() {
-
-        if ( isset($_GET['preview_id']) && isset($_GET['preview_nonce']) ) {
-                $id = (int) $_GET['preview_id'];
-
-                if ( false == wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $id ) )
-                        wp_die( __('You do not have permission to preview drafts.') );
-
-                add_filter('the_preview', '_set_preview');
-        }
-}
-
 /**
  * Filters post meta retrieval to get values from the actual autosave post,
  * and not its parent. Filters revisioned meta keys only.