fix: correct nonce action for Classic Editor post saves#873
Merged
fix: correct nonce action for Classic Editor post saves#873
Conversation
The nonce verification in save_post_subscriptions() was using the wrong
action string ('editpost'), which caused WordPress to reject legitimate
save requests from users with Editor role when using Classic Editor.
Classic Editor's edit form nonces use 'update-post_{$post_id}' as the
action, so the verification must match this to prevent "Cheatin' uh?"
errors on post save.
This regression was introduced in the PHPCS fixes (PR #866) and broke
existing functionality for Editor role users, as reported on the
WordPress.org support forums.
The fix ensures compatibility with Classic Editor whilst maintaining
the security benefits of nonce verification. Integration tests verify
the nonce check now correctly accepts Classic Editor nonces and rejects
those created with the wrong action.
Fixes: https://wordpress.org/support/topic/upgrading-to-0-10-0-breaks-funtionality-for-editor-role/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
GaryJones
force-pushed
the
fix/classic-editor-nonce-check
branch
from
2e18199 to
7ee2706
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
save_post_subscriptions()that was using the wrong action stringupdate-post_{$post_id}as the nonce action, noteditpostProblem
After upgrading to 0.10.0, users with Editor role were getting "Cheatin' uh?" errors when saving posts in Classic Editor. This was caused by the PHPCS fixes in PR #866 which added a nonce check using an incorrect action string.
Solution
Changed the nonce verification from:
To:
Test plan
NotificationsClassicEditorTest.php)Fixes: https://wordpress.org/support/topic/upgrading-to-0-10-0-breaks-funtionality-for-editor-role/
🤖 Generated with Claude Code