Ticket #51483: 51483.2.patch

src/wp-admin/includes/post.php

@@ -2300 +2300 @@
         // Render meta boxes.
         ?>
         <form class="metabox-base-form">
-        <?php the_block_editor_meta_box_post_form_hidden_fields( $post ); ?>
+                <?php the_block_editor_meta_box_post_form_hidden_fields( $post ); ?>
         </form>
         <form id="toggle-custom-fields-form" method="post" action="<?php echo esc_attr( admin_url( 'post.php' ) ); ?>">
-                <?php wp_nonce_field( 'toggle-custom-fields' ); ?>
-                <input type="hidden" name="action" value="toggle-custom-fields" />
+                <?php wp_nonce_field( 'toggle-custom-fields', 'toggle-custom-fields-nonce' ); ?>
+                <input type="hidden" name="action" value="toggle-custom-fields"/>
         </form>
         <?php foreach ( $locations as $location ) : ?>
                 <form class="metabox-location-<?php echo esc_attr( $location ); ?>" onsubmit="return false;">
@@ -2421 +2421 @@
         $referer      = wp_get_referer();
         $current_user = wp_get_current_user();
         $user_id      = $current_user->ID;
-        wp_nonce_field( $nonce_action );
+        wp_nonce_field( $nonce_action, $nonce_action . '-nonce' );
 
         /*
          * Some meta boxes hook into these actions to add hidden input fields in the classic post form. For backwards
@@ -2435 +2435 @@
         $classic_output = ob_get_clean();
 
         $classic_elements = wp_html_split( $classic_output );
-        $hidden_inputs    = '';
         foreach ( $classic_elements as $element ) {
                 if ( 0 !== strpos( $element, '<input ' ) ) {
                         continue;