Ticket #57395: 57395.diff

wp-includes/revision.php

@@ -722 +722 @@
  * @access private
  */
 function _show_post_preview() {
+
         if ( isset( $_GET['preview_id'] ) && isset( $_GET['preview_nonce'] ) ) {
+
+                if ( ! is_user_logged_in() ) {
+                        wp_die( __( 'Sorry, you are not allowed to preview drafts. Unauthorized request.' ), 401 );
+                }
+
                 $id = (int) $_GET['preview_id'];
 
                 if ( false === wp_verify_nonce( $_GET['preview_nonce'], 'post_preview_' . $id ) ) {
-                        wp_die( __( 'Sorry, you are not allowed to preview drafts.' ), 403 );
+                        wp_die( __( 'Sorry, you are not allowed to preview drafts. Nonce is invalid.' ), 403 );
                 }
 
                 add_filter( 'the_preview', '_set_preview' );
+
         }
+
 }
 
 /**