Duplicate _ajax_nonce input cause conflict between find_post_div and post_custom_div

[charlesstpierre]

I ran into the error today. Here is the situation

On Post edit page, I’ve added the FindPost functionality. I’ve included find_posts_div using the admin_footer hook, as normal. It is added to 2 custom post types without custom-fields support and to the regular Post post type.

It worked flawlessly on both custom post types, but the ajax call to get the post list from inside the Post edit page, sent back a 403. I’ve isolated the problem to the _ajax_nonce value, which was different from the 2 others post types.

After checking the source of the admin page, I saw that there was 2 _ajax_nonce fields, and that the value sent to Find-Posts query was the _ajax_nonce from the Custom-Post-field.

More over, I’ve checked and both _ajax_nonce inputs share the same ID (_ajax_nonce). Poor media.js can’t find the right one on line 107.

So, they must be differentiated. Easiest fix would be to change the ID of the _ajax_nonce input in FindPostDiv.

Further more, the Post Custom div interface creates duplicate #_ajax_nonce for each custom fields (at least with the same value). Feel free to create another ticket for this.

The Find Posts modal used the generic _ajax_nonce field name and ID. On post edit screens with the Custom Fields meta box, that produced duplicate #_ajax_nonce elements, so media.js could read the Custom Fields nonce and the Find Posts request would fail with a 403 response.

This gives the Find Posts nonce a dedicated _ajax_nonce-find-posts field and updates the AJAX request to read it while continuing to send the nonce under the _ajax_nonce request key expected by the server.

A regression test verifies that find_posts_div() renders the unique nonce ID and no longer renders id="_ajax_nonce".

Validation:

• phpunit --filter Tests_Admin_IncludesTemplate (43 tests, 125 assertions)
• grunt jshint:core --file=src/js/_enqueues/admin/media.js
• phpcbf src/wp-admin/includes/template.php tests/phpunit/tests/admin/includesTemplate.php
• phpcs src/wp-admin/includes/template.php tests/phpunit/tests/admin/includesTemplate.php