From 17146f7192cd1c63ccde76be93d75465ccd32900 Mon Sep 17 00:00:00 2001 From: Dominik Schilling Date: Wed, 20 Mar 2019 08:11:05 +0000 Subject: [PATCH] Meta Boxes: Use a unique name for the nonce of the meta box loader. Fixes a case where saving in the block editor fails if there are two `_wpnonce` arguments in the request, one overriding the other so that `use_block_editor_for_post()` wasn't able to check the nonce properly. Props Chouby. See #45253. git-svn-id: https://develop.svn.wordpress.org/trunk@44938 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/edit-form-blocks.php | 8 ++++---- src/wp-admin/includes/post.php | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/wp-admin/edit-form-blocks.php b/src/wp-admin/edit-form-blocks.php index 2e651d3f28..0ae82cb3a3 100644 --- a/src/wp-admin/edit-form-blocks.php +++ b/src/wp-admin/edit-form-blocks.php @@ -117,10 +117,10 @@ wp_add_inline_script( $meta_box_url = admin_url( 'post.php' ); $meta_box_url = add_query_arg( array( - 'post' => $post->ID, - 'action' => 'edit', - 'meta-box-loader' => true, - '_wpnonce' => wp_create_nonce( 'meta-box-loader' ), + 'post' => $post->ID, + 'action' => 'edit', + 'meta-box-loader' => true, + 'meta-box-loader-nonce' => wp_create_nonce( 'meta-box-loader' ), ), $meta_box_url ); diff --git a/src/wp-admin/includes/post.php b/src/wp-admin/includes/post.php index 0e19876e51..482d948bbc 100644 --- a/src/wp-admin/includes/post.php +++ b/src/wp-admin/includes/post.php @@ -2071,7 +2071,7 @@ function use_block_editor_for_post( $post ) { // We're in the meta box loader, so don't use the block editor. if ( isset( $_GET['meta-box-loader'] ) ) { - check_admin_referer( 'meta-box-loader' ); + check_admin_referer( 'meta-box-loader', 'meta-box-loader-nonce' ); return false; }