WordPress.org

Make WordPress Core

Changeset 27334


Ignore:
Timestamp:
02/28/2014 11:28:44 PM (7 years ago)
Author:
johnbillion
Message:

Pass along preview query args only if they are already present. Avoids sloppily appending a preview nonce when there should not be one. See #17157.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/post-template.php

    r27333 r27334  
    720720        ), $url );
    721721
    722         if ( 'draft' !== $post->post_status ) {
     722        if ( ( 'draft' !== $post->post_status ) && isset( $_GET['preview_id'], $_GET['preview_nonce'] ) ) {
    723723            $url = add_query_arg( array(
    724                 'preview_id'    => $post->ID,
    725                 'preview_nonce' => wp_create_nonce( 'post_preview_' . $post->ID )
     724                'preview_id'    => wp_unslash( $_GET['preview_id'] ),
     725                'preview_nonce' => wp_unslash( $_GET['preview_nonce'] )
    726726            ), $url );
    727727        }
Note: See TracChangeset for help on using the changeset viewer.