WordPress.org

Make WordPress Core

Changeset 44938


Ignore:
Timestamp:
03/20/2019 08:11:05 AM (5 months ago)
Author:
ocean90
Message:

Meta Boxes: Use a unique name for the nonce of the meta box loader.

Fixes a case where saving in the block editor fails if there are two _wpnonce arguments in the request, one overriding the other so that use_block_editor_for_post() wasn't able to check the nonce properly.

Props Chouby.
See #45253.

Location:
trunk/src/wp-admin
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/edit-form-blocks.php

    r44808 r44938  
    118118$meta_box_url = add_query_arg(
    119119    array(
    120         'post'            => $post->ID,
    121         'action'          => 'edit',
    122         'meta-box-loader' => true,
    123         '_wpnonce'        => wp_create_nonce( 'meta-box-loader' ),
     120        'post'                  => $post->ID,
     121        'action'                => 'edit',
     122        'meta-box-loader'       => true,
     123        'meta-box-loader-nonce' => wp_create_nonce( 'meta-box-loader' ),
    124124    ),
    125125    $meta_box_url
  • trunk/src/wp-admin/includes/post.php

    r44670 r44938  
    20722072    // We're in the meta box loader, so don't use the block editor.
    20732073    if ( isset( $_GET['meta-box-loader'] ) ) {
    2074         check_admin_referer( 'meta-box-loader' );
     2074        check_admin_referer( 'meta-box-loader', 'meta-box-loader-nonce' );
    20752075        return false;
    20762076    }
Note: See TracChangeset for help on using the changeset viewer.