From ad74207fa7b52ec671a6c5aaf0cab189173fcc23 Mon Sep 17 00:00:00 2001
From: "Dominik Schilling (ocean90)" <ocean90@git.wordpress.org>
Date: Mon, 3 Aug 2015 21:11:35 +0000
Subject: [PATCH] Heartbeat: Ensure post locks are released.

git-svn-id: https://develop.svn.wordpress.org/trunk@33542 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/post.php | 2 +-
 src/wp-admin/post.php          | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/wp-admin/includes/post.php b/src/wp-admin/includes/post.php
index 1968e9662e..5fcceec001 100644
--- a/src/wp-admin/includes/post.php
+++ b/src/wp-admin/includes/post.php
@@ -1568,7 +1568,7 @@ function _admin_notice_post_locked() {
 		// Allow plugins to prevent some users overriding the post lock
 		if ( $override ) {
 			?>
-			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', get_edit_post_link( $post->ID, 'url' ) ) ); ?>"><?php _e('Take over'); ?></a>
+			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', wp_nonce_url( get_edit_post_link( $post->ID, 'url' ), 'lock-post_' . $post->ID ) ) ); ?>"><?php _e('Take over'); ?></a>
 			<?php
 		}
 
diff --git a/src/wp-admin/post.php b/src/wp-admin/post.php
index bc71c44b53..89bdc38ce0 100644
--- a/src/wp-admin/post.php
+++ b/src/wp-admin/post.php
@@ -165,6 +165,7 @@ case 'edit':
 		wp_die( __( 'You can&#8217;t edit this item because it is in the Trash. Please restore it and try again.' ) );
 
 	if ( ! empty( $_GET['get-post-lock'] ) ) {
+		check_admin_referer( 'lock-post_' . $post_id );
 		wp_set_post_lock( $post_id );
 		wp_redirect( get_edit_post_link( $post_id, 'url' ) );
 		exit();