diff --git a/src/wp-admin/css/press-this.css b/src/wp-admin/css/press-this.css index f1dad4006a..d395580b4d 100644 --- a/src/wp-admin/css/press-this.css +++ b/src/wp-admin/css/press-this.css @@ -351,6 +351,10 @@ strong { text-decoration: underline; } +.preview-button { + margin-right: 1em; +} + .button-reset { margin: 0; padding: 0; diff --git a/src/wp-admin/includes/class-wp-press-this.php b/src/wp-admin/includes/class-wp-press-this.php index c5e9eb378d..5494ae741f 100644 --- a/src/wp-admin/includes/class-wp-press-this.php +++ b/src/wp-admin/includes/class-wp-press-this.php @@ -133,22 +133,20 @@ class WP_Press_This { * @access public */ public function save_post() { - if ( empty( $_POST['pressthis-nonce'] ) || ! wp_verify_nonce( $_POST['pressthis-nonce'], 'press-this' ) ) { - wp_send_json_error( array( 'errorMessage' => __( 'Cheatin’ uh?' ) ) ); - } - if ( empty( $_POST['post_ID'] ) || ! $post_id = (int) $_POST['post_ID'] ) { wp_send_json_error( array( 'errorMessage' => __( 'Missing post ID.' ) ) ); } - if ( ! current_user_can( 'edit_post', $post_id ) ) { - wp_send_json_error( array( 'errorMessage' => __( 'Cheatin’ uh?' ) ) ); + if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'update-post_' . $post_id ) || + ! current_user_can( 'edit_post', $post_id ) ) { + + wp_send_json_error( array( 'errorMessage' => __( 'Invalid post.' ) ) ); } $post = array( 'ID' => $post_id, - 'post_title' => ( ! empty( $_POST['title'] ) ) ? sanitize_text_field( trim( $_POST['title'] ) ) : '', - 'post_content' => ( ! empty( $_POST['pressthis'] ) ) ? trim( $_POST['pressthis'] ) : '', + 'post_title' => ( ! empty( $_POST['post_title'] ) ) ? sanitize_text_field( trim( $_POST['post_title'] ) ) : '', + 'post_content' => ( ! empty( $_POST['post_content'] ) ) ? trim( $_POST['post_content'] ) : '', 'post_type' => 'post', 'post_status' => 'draft', 'post_format' => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '', @@ -887,7 +885,7 @@ class WP_Press_This { >
- +