1 <?php

     2 /**

     3  * WordPress Core Ajax Handlers.

     4  *

     5  * @package WordPress

     6  * @subpackage Administration

     7  */

     8 

     9 /*

    10  * No-privilege Ajax handlers.

    11  */

    12 

    13 /**

    14  * Heartbeat API (experimental)

    15  *

    16  * Runs when the user is not logged in.

    17  */

    18 function wp_ajax_nopriv_heartbeat() {

    19 	$response = array();

    20 

    21 	// screen_id is the same as $current_screen->id and the JS global 'pagenow'

    22 	if ( ! empty($_POST['screen_id']) )

    23 		$screen_id = sanitize_key($_POST['screen_id']);

    24 	else

    25 		$screen_id = 'front';

    26 

    27 	if ( ! empty($_POST['data']) ) {

    28 		$data = wp_unslash( (array) $_POST['data'] );

    29 

    30 		/**

    31 		 * Filter Heartbeat AJAX response in no-privilege environments.

    32 		 *

    33 		 * @since 3.6.0

    34 		 *

    35 		 * @param array|object $response  The no-priv Heartbeat response object or array.

    36 		 * @param array        $data      An array of data passed via $_POST.

    37 		 * @param string       $screen_id The screen id.

    38 		 */

    39 		$response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );

    40 	}

    41 

    42 	/**

    43 	 * Filter Heartbeat AJAX response when no data is passed.

    44 	 *

    45 	 * @since 3.6.0

    46 	 *

    47 	 * @param array|object $response  The Heartbeat response object or array.

    48 	 * @param string       $screen_id The screen id.

    49 	 */

    50 	$response = apply_filters( 'heartbeat_nopriv_send', $response, $screen_id );

    51 

    52 	/**

    53 	 * Fires when Heartbeat ticks in no-privilege environments.

    54 	 *

    55 	 * Allows the transport to be easily replaced with long-polling.

    56 	 *

    57 	 * @since 3.6.0

    58 	 *

    59 	 * @param array|object $response  The no-priv Heartbeat response.

    60 	 * @param string       $screen_id The screen id.

    61 	 */

    62 	do_action( 'heartbeat_nopriv_tick', $response, $screen_id );

    63 

    64 	// send the current time according to the server

    65 	$response['server_time'] = time();

    66 

    67 	wp_send_json($response);

    68 }

    69 

    70 /*

    71  * GET-based Ajax handlers.

    72  */

    73 function wp_ajax_fetch_list() {

    74 	global $wp_list_table;

    75 

    76 	$list_class = $_GET['list_args']['class'];

    77 	check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );

    78 

    79 	$wp_list_table = _get_list_table( $list_class, array( 'screen' => $_GET['list_args']['screen']['id'] ) );

    80 	if ( ! $wp_list_table )

    81 		wp_die( 0 );

    82 

    83 	if ( ! $wp_list_table->ajax_user_can() )

    84 		wp_die( -1 );

    85 

    86 	$wp_list_table->ajax_response();

    87 

    88 	wp_die( 0 );

    89 }

    90 function wp_ajax_ajax_tag_search() {

    91 	global $wpdb;

    92 

    93 	if ( isset( $_GET['tax'] ) ) {

    94 		$taxonomy = sanitize_key( $_GET['tax'] );

    95 		$tax = get_taxonomy( $taxonomy );

    96 		if ( ! $tax )

    97 			wp_die( 0 );

    98 		if ( ! current_user_can( $tax->cap->assign_terms ) )

    99 			wp_die( -1 );

   100 	} else {

   101 		wp_die( 0 );

   102 	}

   103 

   104 	$s = wp_unslash( $_GET['q'] );

   105 

   106 	$comma = _x( ',', 'tag delimiter' );

   107 	if ( ',' !== $comma )

   108 		$s = str_replace( $comma, ',', $s );

   109 	if ( false !== strpos( $s, ',' ) ) {

   110 		$s = explode( ',', $s );

   111 		$s = $s[count( $s ) - 1];

   112 	}

   113 	$s = trim( $s );

   114 	if ( strlen( $s ) < 2 )

   115 		wp_die(); // require 2 chars for matching

   116 

   117 	$results = get_terms( $taxonomy, array( 'name__like' => $s, 'fields' => 'names', 'hide_empty' => false ) );

   118 

   119 	echo join( $results, "\n" );

   120 	wp_die();

   121 }

   122 

   123 function wp_ajax_wp_compression_test() {

   124 	if ( !current_user_can( 'manage_options' ) )

   125 		wp_die( -1 );

   126 

   127 	if ( ini_get('zlib.output_compression') || 'ob_gzhandler' == ini_get('output_handler') ) {

   128 		update_site_option('can_compress_scripts', 0);

   129 		wp_die( 0 );

   130 	}

   131 

   132 	if ( isset($_GET['test']) ) {

   133 		header( 'Expires: Wed, 11 Jan 1984 05:00:00 GMT' );

   134 		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );

   135 		header( 'Cache-Control: no-cache, must-revalidate, max-age=0' );

   136 		header( 'Pragma: no-cache' );

   137 		header('Content-Type: application/x-javascript; charset=UTF-8');

   138 		$force_gzip = ( defined('ENFORCE_GZIP') && ENFORCE_GZIP );

   139 		$test_str = '"wpCompressionTest Lorem ipsum dolor sit amet consectetuer mollis sapien urna ut a. Eu nonummy condimentum fringilla tempor pretium platea vel nibh netus Maecenas. Hac molestie amet justo quis pellentesque est ultrices interdum nibh Morbi. Cras mattis pretium Phasellus ante ipsum ipsum ut sociis Suspendisse Lorem. Ante et non molestie. Porta urna Vestibulum egestas id congue nibh eu risus gravida sit. Ac augue auctor Ut et non a elit massa id sodales. Elit eu Nulla at nibh adipiscing mattis lacus mauris at tempus. Netus nibh quis suscipit nec feugiat eget sed lorem et urna. Pellentesque lacus at ut massa consectetuer ligula ut auctor semper Pellentesque. Ut metus massa nibh quam Curabitur molestie nec mauris congue. Volutpat molestie elit justo facilisis neque ac risus Ut nascetur tristique. Vitae sit lorem tellus et quis Phasellus lacus tincidunt nunc Fusce. Pharetra wisi Suspendisse mus sagittis libero lacinia Integer consequat ac Phasellus. Et urna ac cursus tortor aliquam Aliquam amet tellus volutpat Vestibulum. Justo interdum condimentum In augue congue tellus sollicitudin Quisque quis nibh."';

   140 

   141 		 if ( 1 == $_GET['test'] ) {

   142 		 	echo $test_str;

   143 		 	wp_die();

   144 		 } elseif ( 2 == $_GET['test'] ) {

   145 			if ( !isset($_SERVER['HTTP_ACCEPT_ENCODING']) )

   146 				wp_die( -1 );

   147 			if ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate') && function_exists('gzdeflate') && ! $force_gzip ) {

   148 				header('Content-Encoding: deflate');

   149 				$out = gzdeflate( $test_str, 1 );

   150 			} elseif ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') && function_exists('gzencode') ) {

   151 				header('Content-Encoding: gzip');

   152 				$out = gzencode( $test_str, 1 );

   153 			} else {

   154 				wp_die( -1 );

   155 			}

   156 			echo $out;

   157 			wp_die();

   158 		} elseif ( 'no' == $_GET['test'] ) {

   159 			update_site_option('can_compress_scripts', 0);

   160 		} elseif ( 'yes' == $_GET['test'] ) {

   161 			update_site_option('can_compress_scripts', 1);

   162 		}

   163 	}

   164 

   165 	wp_die( 0 );

   166 }

   167 

   168 function wp_ajax_imgedit_preview() {

   169 	$post_id = intval($_GET['postid']);

   170 	if ( empty($post_id) || !current_user_can('edit_post', $post_id) )

   171 		wp_die( -1 );

   172 

   173 	check_ajax_referer( "image_editor-$post_id" );

   174 

   175 	include_once( ABSPATH . 'wp-admin/includes/image-edit.php' );

   176 	if ( ! stream_preview_image($post_id) )

   177 		wp_die( -1 );

   178 

   179 	wp_die();

   180 }

   181 

   182 function wp_ajax_oembed_cache() {

   183 	global $wp_embed;

   184 

   185 	$return = ( $wp_embed->cache_oembed( $_GET['post'] ) ) ? '1' : '0';

   186 	wp_die( $return );

   187 }

   188 

   189 function wp_ajax_autocomplete_user() {

   190 	if ( ! is_multisite() || ! current_user_can( 'promote_users' ) || wp_is_large_network( 'users' ) )

   191 		wp_die( -1 );

   192 

   193 	/** This filter is documented in wp-admin/user-new.php */

   194 	if ( ! is_super_admin() && ! apply_filters( 'autocomplete_users_for_site_admins', false ) )

   195 		wp_die( -1 );

   196 

   197 	$return = array();

   198 

   199 	// Check the type of request

   200 	if ( isset( $_REQUEST['autocomplete_type'] ) )

   201 		$type = $_REQUEST['autocomplete_type'];

   202 	else

   203 		$type = 'add';

   204 

   205 	// Exclude current users of this blog

   206 	if ( isset( $_REQUEST['site_id'] ) )

   207 		$id = absint( $_REQUEST['site_id'] );

   208 	else

   209 		$id = get_current_blog_id();

   210 

   211 	$include_blog_users = ( $type == 'search' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );

   212 	$exclude_blog_users = ( $type == 'add' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );

   213 

   214 	$users = get_users( array(

   215 		'blog_id' => false,

   216 		'search'  => '*' . $_REQUEST['term'] . '*',

   217 		'include' => $include_blog_users,

   218 		'exclude' => $exclude_blog_users,

   219 		'search_columns' => array( 'user_login', 'user_nicename', 'user_email' ),

   220 	) );

   221 

   222 	foreach ( $users as $user ) {

   223 		$return[] = array(

   224 			/* translators: 1: user_login, 2: user_email */

   225 			'label' => sprintf( __( '%1$s (%2$s)' ), $user->user_login, $user->user_email ),

   226 			'value' => $user->user_login,

   227 		);

   228 	}

   229 

   230 	wp_die( json_encode( $return ) );

   231 }

   232 

   233 function wp_ajax_dashboard_widgets() {

   234 	require_once ABSPATH . 'wp-admin/includes/dashboard.php';

   235 

   236 	switch ( $_GET['widget'] ) {

   237 		case 'dashboard_incoming_links' :

   238 			wp_dashboard_incoming_links();

   239 			break;

   240 		case 'dashboard_primary' :

   241 			wp_dashboard_primary();

   242 			break;

   243 		case 'dashboard_secondary' :

   244 			wp_dashboard_secondary();

   245 			break;

   246 		case 'dashboard_plugins' :

   247 			wp_dashboard_plugins();

   248 			break;

   249 	}

   250 	wp_die();

   251 }

   252 

   253 function wp_ajax_logged_in() {

   254 	wp_die( 1 );

   255 }

   256 

   257 /*

   258  * Ajax helper.

   259  */

   260 

   261 /**

   262  * Sends back current comment total and new page links if they need to be updated.

   263  *

   264  * Contrary to normal success AJAX response ("1"), die with time() on success.

   265  *

   266  * @since 2.7

   267  *

   268  * @param int $comment_id

   269  * @return die

   270  */

   271 function _wp_ajax_delete_comment_response( $comment_id, $delta = -1 ) {

   272 	$total    = isset( $_POST['_total'] )    ? (int) $_POST['_total']    : 0;

   273 	$per_page = isset( $_POST['_per_page'] ) ? (int) $_POST['_per_page'] : 0;

   274 	$page     = isset( $_POST['_page'] )     ? (int) $_POST['_page']     : 0;

   275 	$url      = isset( $_POST['_url'] )      ? esc_url_raw( $_POST['_url'] ) : '';

   276 

   277 	// JS didn't send us everything we need to know. Just die with success message

   278 	if ( !$total || !$per_page || !$page || !$url )

   279 		wp_die( time() );

   280 

   281 	$total += $delta;

   282 	if ( $total < 0 )

   283 		$total = 0;

   284 

   285 	// Only do the expensive stuff on a page-break, and about 1 other time per page

   286 	if ( 0 == $total % $per_page || 1 == mt_rand( 1, $per_page ) ) {

   287 		$post_id = 0;

   288 		$status = 'total_comments'; // What type of comment count are we looking for?

   289 		$parsed = parse_url( $url );

   290 		if ( isset( $parsed['query'] ) ) {

   291 			parse_str( $parsed['query'], $query_vars );

   292 			if ( !empty( $query_vars['comment_status'] ) )

   293 				$status = $query_vars['comment_status'];

   294 			if ( !empty( $query_vars['p'] ) )

   295 				$post_id = (int) $query_vars['p'];

   296 		}

   297 

   298 		$comment_count = wp_count_comments($post_id);

   299 

   300 		if ( isset( $comment_count->$status ) ) // We're looking for a known type of comment count

   301 			$total = $comment_count->$status;

   302 			// else use the decremented value from above

   303 	}

   304 

   305 	$time = time(); // The time since the last comment count

   306 

   307 	$x = new WP_Ajax_Response( array(

   308 		'what' => 'comment',

   309 		'id' => $comment_id, // here for completeness - not used

   310 		'supplemental' => array(

   311 			'total_items_i18n' => sprintf( _n( '1 item', '%s items', $total ), number_format_i18n( $total ) ),

   312 			'total_pages' => ceil( $total / $per_page ),

   313 			'total_pages_i18n' => number_format_i18n( ceil( $total / $per_page ) ),

   314 			'total' => $total,

   315 			'time' => $time

   316 		)

   317 	) );

   318 	$x->send();

   319 }

   320 

   321 /*

   322  * POST-based Ajax handlers.

   323  */

   324 

   325 function _wp_ajax_add_hierarchical_term() {

   326 	$action = $_POST['action'];

   327 	$taxonomy = get_taxonomy(substr($action, 4));

   328 	check_ajax_referer( $action, '_ajax_nonce-add-' . $taxonomy->name );

   329 	if ( !current_user_can( $taxonomy->cap->edit_terms ) )

   330 		wp_die( -1 );

   331 	$names = explode(',', $_POST['new'.$taxonomy->name]);

   332 	$parent = isset($_POST['new'.$taxonomy->name.'_parent']) ? (int) $_POST['new'.$taxonomy->name.'_parent'] : 0;

   333 	if ( 0 > $parent )

   334 		$parent = 0;

   335 	if ( $taxonomy->name == 'category' )

   336 		$post_category = isset($_POST['post_category']) ? (array) $_POST['post_category'] : array();

   337 	else

   338 		$post_category = ( isset($_POST['tax_input']) && isset($_POST['tax_input'][$taxonomy->name]) ) ? (array) $_POST['tax_input'][$taxonomy->name] : array();

   339 	$checked_categories = array_map( 'absint', (array) $post_category );

   340 	$popular_ids = wp_popular_terms_checklist($taxonomy->name, 0, 10, false);

   341 

   342 	foreach ( $names as $cat_name ) {

   343 		$cat_name = trim($cat_name);

   344 		$category_nicename = sanitize_title($cat_name);

   345 		if ( '' === $category_nicename )

   346 			continue;

   347 		if ( !$cat_id = term_exists( $cat_name, $taxonomy->name, $parent ) )

   348 			$cat_id = wp_insert_term( $cat_name, $taxonomy->name, array( 'parent' => $parent ) );

   349 		if ( is_wp_error( $cat_id ) )

   350 			continue;

   351 		else if ( is_array( $cat_id ) )

   352 			$cat_id = $cat_id['term_id'];

   353 		$checked_categories[] = $cat_id;

   354 		if ( $parent ) // Do these all at once in a second

   355 			continue;

   356 		ob_start();

   357 			wp_terms_checklist( 0, array( 'taxonomy' => $taxonomy->name, 'descendants_and_self' => $cat_id, 'selected_cats' => $checked_categories, 'popular_cats' => $popular_ids ));

   358 		$data = ob_get_contents();

   359 		ob_end_clean();

   360 		$add = array(

   361 			'what' => $taxonomy->name,

   362 			'id' => $cat_id,

   363 			'data' => str_replace( array("\n", "\t"), '', $data),

   364 			'position' => -1

   365 		);

   366 	}

   367 

   368 	if ( $parent ) { // Foncy - replace the parent and all its children

   369 		$parent = get_term( $parent, $taxonomy->name );

   370 		$term_id = $parent->term_id;

   371 

   372 		while ( $parent->parent ) { // get the top parent

   373 			$parent = get_term( $parent->parent, $taxonomy->name );

   374 			if ( is_wp_error( $parent ) )

   375 				break;

   376 			$term_id = $parent->term_id;

   377 		}

   378 

   379 		ob_start();

   380 			wp_terms_checklist( 0, array('taxonomy' => $taxonomy->name, 'descendants_and_self' => $term_id, 'selected_cats' => $checked_categories, 'popular_cats' => $popular_ids));

   381 		$data = ob_get_contents();

   382 		ob_end_clean();

   383 		$add = array(

   384 			'what' => $taxonomy->name,

   385 			'id' => $term_id,

   386 			'data' => str_replace( array("\n", "\t"), '', $data),

   387 			'position' => -1

   388 		);

   389 	}

   390 

   391 	ob_start();

   392 		wp_dropdown_categories( array(

   393 			'taxonomy' => $taxonomy->name, 'hide_empty' => 0, 'name' => 'new'.$taxonomy->name.'_parent', 'orderby' => 'name',

   394 			'hierarchical' => 1, 'show_option_none' => '— '.$taxonomy->labels->parent_item.' —'

   395 		) );

   396 	$sup = ob_get_contents();

   397 	ob_end_clean();

   398 	$add['supplemental'] = array( 'newcat_parent' => $sup );

   399 

   400 	$x = new WP_Ajax_Response( $add );

   401 	$x->send();

   402 }

   403 

   404 function wp_ajax_delete_comment() {

   405 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   406 

   407 	if ( !$comment = get_comment( $id ) )

   408 		wp_die( time() );

   409 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) )

   410 		wp_die( -1 );

   411 

   412 	check_ajax_referer( "delete-comment_$id" );

   413 	$status = wp_get_comment_status( $comment->comment_ID );

   414 

   415 	$delta = -1;

   416 	if ( isset($_POST['trash']) && 1 == $_POST['trash'] ) {

   417 		if ( 'trash' == $status )

   418 			wp_die( time() );

   419 		$r = wp_trash_comment( $comment->comment_ID );

   420 	} elseif ( isset($_POST['untrash']) && 1 == $_POST['untrash'] ) {

   421 		if ( 'trash' != $status )

   422 			wp_die( time() );

   423 		$r = wp_untrash_comment( $comment->comment_ID );

   424 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'trash' ) // undo trash, not in trash

   425 			$delta = 1;

   426 	} elseif ( isset($_POST['spam']) && 1 == $_POST['spam'] ) {

   427 		if ( 'spam' == $status )

   428 			wp_die( time() );

   429 		$r = wp_spam_comment( $comment->comment_ID );

   430 	} elseif ( isset($_POST['unspam']) && 1 == $_POST['unspam'] ) {

   431 		if ( 'spam' != $status )

   432 			wp_die( time() );

   433 		$r = wp_unspam_comment( $comment->comment_ID );

   434 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'spam' ) // undo spam, not in spam

   435 			$delta = 1;

   436 	} elseif ( isset($_POST['delete']) && 1 == $_POST['delete'] ) {

   437 		$r = wp_delete_comment( $comment->comment_ID );

   438 	} else {

   439 		wp_die( -1 );

   440 	}

   441 

   442 	if ( $r ) // Decide if we need to send back '1' or a more complicated response including page links and comment counts

   443 		_wp_ajax_delete_comment_response( $comment->comment_ID, $delta );

   444 	wp_die( 0 );

   445 }

   446 

   447 function wp_ajax_delete_tag() {

   448 	$tag_id = (int) $_POST['tag_ID'];

   449 	check_ajax_referer( "delete-tag_$tag_id" );

   450 

   451 	$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';

   452 	$tax = get_taxonomy($taxonomy);

   453 

   454 	if ( !current_user_can( $tax->cap->delete_terms ) )

   455 		wp_die( -1 );

   456 

   457 	$tag = get_term( $tag_id, $taxonomy );

   458 	if ( !$tag || is_wp_error( $tag ) )

   459 		wp_die( 1 );

   460 

   461 	if ( wp_delete_term($tag_id, $taxonomy))

   462 		wp_die( 1 );

   463 	else

   464 		wp_die( 0 );

   465 }

   466 

   467 function wp_ajax_delete_link() {

   468 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   469 

   470 	check_ajax_referer( "delete-bookmark_$id" );

   471 	if ( !current_user_can( 'manage_links' ) )

   472 		wp_die( -1 );

   473 

   474 	$link = get_bookmark( $id );

   475 	if ( !$link || is_wp_error( $link ) )

   476 		wp_die( 1 );

   477 

   478 	if ( wp_delete_link( $id ) )

   479 		wp_die( 1 );

   480 	else

   481 		wp_die( 0 );

   482 }

   483 

   484 function wp_ajax_delete_meta() {

   485 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   486 

   487 	check_ajax_referer( "delete-meta_$id" );

   488 	if ( !$meta = get_metadata_by_mid( 'post', $id ) )

   489 		wp_die( 1 );

   490 

   491 	if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta',  $meta->post_id, $meta->meta_key ) )

   492 		wp_die( -1 );

   493 	if ( delete_meta( $meta->meta_id ) )

   494 		wp_die( 1 );

   495 	wp_die( 0 );

   496 }

   497 

   498 function wp_ajax_delete_post( $action ) {

   499 	if ( empty( $action ) )

   500 		$action = 'delete-post';

   501 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   502 

   503 	check_ajax_referer( "{$action}_$id" );

   504 	if ( !current_user_can( 'delete_post', $id ) )

   505 		wp_die( -1 );

   506 

   507 	if ( !get_post( $id ) )

   508 		wp_die( 1 );

   509 

   510 	if ( wp_delete_post( $id ) )

   511 		wp_die( 1 );

   512 	else

   513 		wp_die( 0 );

   514 }

   515 

   516 function wp_ajax_trash_post( $action ) {

   517 	if ( empty( $action ) )

   518 		$action = 'trash-post';

   519 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   520 

   521 	check_ajax_referer( "{$action}_$id" );

   522 	if ( !current_user_can( 'delete_post', $id ) )

   523 		wp_die( -1 );

   524 

   525 	if ( !get_post( $id ) )

   526 		wp_die( 1 );

   527 

   528 	if ( 'trash-post' == $action )

   529 		$done = wp_trash_post( $id );

   530 	else

   531 		$done = wp_untrash_post( $id );

   532 

   533 	if ( $done )

   534 		wp_die( 1 );

   535 

   536 	wp_die( 0 );

   537 }

   538 

   539 function wp_ajax_untrash_post( $action ) {

   540 	if ( empty( $action ) )

   541 		$action = 'untrash-post';

   542 	wp_ajax_trash_post( $action );

   543 }

   544 

   545 function wp_ajax_delete_page( $action ) {

   546 	if ( empty( $action ) )

   547 		$action = 'delete-page';

   548 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   549 

   550 	check_ajax_referer( "{$action}_$id" );

   551 	if ( !current_user_can( 'delete_page', $id ) )

   552 		wp_die( -1 );

   553 

   554 	if ( ! get_post( $id ) )

   555 		wp_die( 1 );

   556 

   557 	if ( wp_delete_post( $id ) )

   558 		wp_die( 1 );

   559 	else

   560 		wp_die( 0 );

   561 }

   562 

   563 function wp_ajax_dim_comment() {

   564 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;

   565 

   566 	if ( !$comment = get_comment( $id ) ) {

   567 		$x = new WP_Ajax_Response( array(

   568 			'what' => 'comment',

   569 			'id' => new WP_Error('invalid_comment', sprintf(__('Comment %d does not exist'), $id))

   570 		) );

   571 		$x->send();

   572 	}

   573 

   574 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) && ! current_user_can( 'moderate_comments' ) )

   575 		wp_die( -1 );

   576 

   577 	$current = wp_get_comment_status( $comment->comment_ID );

   578 	if ( isset( $_POST['new'] ) && $_POST['new'] == $current )

   579 		wp_die( time() );

   580 

   581 	check_ajax_referer( "approve-comment_$id" );

   582 	if ( in_array( $current, array( 'unapproved', 'spam' ) ) )

   583 		$result = wp_set_comment_status( $comment->comment_ID, 'approve', true );

   584 	else

   585 		$result = wp_set_comment_status( $comment->comment_ID, 'hold', true );

   586 

   587 	if ( is_wp_error($result) ) {

   588 		$x = new WP_Ajax_Response( array(

   589 			'what' => 'comment',

   590 			'id' => $result

   591 		) );

   592 		$x->send();

   593 	}

   594 

   595 	// Decide if we need to send back '1' or a more complicated response including page links and comment counts

   596 	_wp_ajax_delete_comment_response( $comment->comment_ID );

   597 	wp_die( 0 );

   598 }

   599 

   600 function wp_ajax_add_link_category( $action ) {

   601 	if ( empty( $action ) )

   602 		$action = 'add-link-category';

   603 	check_ajax_referer( $action );

   604 	if ( !current_user_can( 'manage_categories' ) )

   605 		wp_die( -1 );

   606 	$names = explode(',', wp_unslash( $_POST['newcat'] ) );

   607 	$x = new WP_Ajax_Response();

   608 	foreach ( $names as $cat_name ) {

   609 		$cat_name = trim($cat_name);

   610 		$slug = sanitize_title($cat_name);

   611 		if ( '' === $slug )

   612 			continue;

   613 		if ( !$cat_id = term_exists( $cat_name, 'link_category' ) )

   614 			$cat_id = wp_insert_term( $cat_name, 'link_category' );

   615 		if ( is_wp_error( $cat_id ) )

   616 			continue;

   617 		else if ( is_array( $cat_id ) )

   618 			$cat_id = $cat_id['term_id'];

   619 		$cat_name = esc_html( $cat_name );

   620 		$x->add( array(

   621 			'what' => 'link-category',

   622 			'id' => $cat_id,

   623 			'data' => "<li id='link-category-$cat_id'><label for='in-link-category-$cat_id' class='selectit'><input value='" . esc_attr($cat_id) . "' type='checkbox' checked='checked' name='link_category[]' id='in-link-category-$cat_id'/> $cat_name</label></li>",

   624 			'position' => -1

   625 		) );

   626 	}

   627 	$x->send();

   628 }

   629 

   630 function wp_ajax_add_tag() {

   631 	global $wp_list_table;

   632 

   633 	check_ajax_referer( 'add-tag', '_wpnonce_add-tag' );

   634 	$post_type = !empty($_POST['post_type']) ? $_POST['post_type'] : 'post';

   635 	$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';

   636 	$tax = get_taxonomy($taxonomy);

   637 

   638 	if ( !current_user_can( $tax->cap->edit_terms ) )

   639 		wp_die( -1 );

   640 

   641 	$x = new WP_Ajax_Response();

   642 

   643 	$tag = wp_insert_term($_POST['tag-name'], $taxonomy, $_POST );

   644 

   645 	if ( !$tag || is_wp_error($tag) || (!$tag = get_term( $tag['term_id'], $taxonomy )) ) {

   646 		$message = __('An error has occurred. Please reload the page and try again.');

   647 		if ( is_wp_error($tag) && $tag->get_error_message() )

   648 			$message = $tag->get_error_message();

   649 

   650 		$x->add( array(

   651 			'what' => 'taxonomy',

   652 			'data' => new WP_Error('error', $message )

   653 		) );

   654 		$x->send();

   655 	}

   656 

   657 	$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );

   658 

   659 	$level = 0;

   660 	if ( is_taxonomy_hierarchical($taxonomy) ) {

   661 		$level = count( get_ancestors( $tag->term_id, $taxonomy ) );

   662 		ob_start();

   663 		$wp_list_table->single_row( $tag, $level );

   664 		$noparents = ob_get_clean();

   665 	}

   666 

   667 	ob_start();

   668 	$wp_list_table->single_row( $tag );

   669 	$parents = ob_get_clean();

   670 

   671 	$x->add( array(

   672 		'what' => 'taxonomy',

   673 		'supplemental' => compact('parents', 'noparents')

   674 		) );

   675 	$x->add( array(

   676 		'what' => 'term',

   677 		'position' => $level,

   678 		'supplemental' => (array) $tag

   679 		) );

   680 	$x->send();

   681 }

   682 

   683 function wp_ajax_get_tagcloud() {

   684 	if ( isset( $_POST['tax'] ) ) {

   685 		$taxonomy = sanitize_key( $_POST['tax'] );

   686 		$tax = get_taxonomy( $taxonomy );

   687 		if ( ! $tax )

   688 			wp_die( 0 );

   689 		if ( ! current_user_can( $tax->cap->assign_terms ) )

   690 			wp_die( -1 );

   691 	} else {

   692 		wp_die( 0 );

   693 	}

   694 

   695 	$tags = get_terms( $taxonomy, array( 'number' => 45, 'orderby' => 'count', 'order' => 'DESC' ) );

   696 

   697 	if ( empty( $tags ) )

   698 		wp_die( $tax->labels->not_found );

   699 

   700 	if ( is_wp_error( $tags ) )

   701 		wp_die( $tags->get_error_message() );

   702 

   703 	foreach ( $tags as $key => $tag ) {

   704 		$tags[ $key ]->link = '#';

   705 		$tags[ $key ]->id = $tag->term_id;

   706 	}

   707 

   708 	// We need raw tag names here, so don't filter the output

   709 	$return = wp_generate_tag_cloud( $tags, array('filter' => 0) );

   710 

   711 	if ( empty($return) )

   712 		wp_die( 0 );

   713 

   714 	echo $return;

   715 

   716 	wp_die();

   717 }

   718 

   719 function wp_ajax_get_comments( $action ) {

   720 	global $wp_list_table, $post_id;

   721 	if ( empty( $action ) )

   722 		$action = 'get-comments';

   723 

   724 	check_ajax_referer( $action );

   725 

   726 	if ( empty( $post_id ) && ! empty( $_REQUEST['p'] ) ) {

   727 		$id = absint( $_REQUEST['p'] );

   728 		if ( ! empty( $id ) )

   729 			$post_id = $id;

   730 	}

   731 

   732 	if ( empty( $post_id ) )

   733 		wp_die( -1 );

   734 

   735 	$wp_list_table = _get_list_table( 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );

   736 

   737 	if ( ! current_user_can( 'edit_post', $post_id ) )

   738 		wp_die( -1 );

   739 

   740 	$wp_list_table->prepare_items();

   741 

   742 	if ( !$wp_list_table->has_items() )

   743 		wp_die( 1 );

   744 

   745 	$x = new WP_Ajax_Response();

   746 	ob_start();

   747 	foreach ( $wp_list_table->items as $comment ) {

   748 		if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) )

   749 			continue;

   750 		get_comment( $comment );

   751 		$wp_list_table->single_row( $comment );

   752 	}

   753 	$comment_list_item = ob_get_contents();

   754 	ob_end_clean();

   755 

   756 	$x->add( array(

   757 		'what' => 'comments',

   758 		'data' => $comment_list_item

   759 	) );

   760 	$x->send();

   761 }

   762 

   763 function wp_ajax_replyto_comment( $action ) {

   764 	global $wp_list_table, $wpdb;

   765 	if ( empty( $action ) )

   766 		$action = 'replyto-comment';

   767 

   768 	check_ajax_referer( $action, '_ajax_nonce-replyto-comment' );

   769 

   770 	$comment_post_ID = (int) $_POST['comment_post_ID'];

   771 	$post = get_post( $comment_post_ID );

   772 	if ( ! $post )

   773 		wp_die( -1 );

   774 

   775 	if ( !current_user_can( 'edit_post', $comment_post_ID ) )

   776 		wp_die( -1 );

   777 

   778 	if ( empty( $post->post_status ) )

   779 		wp_die( 1 );

   780 	elseif ( in_array($post->post_status, array('draft', 'pending', 'trash') ) )

   781 		wp_die( __('ERROR: you are replying to a comment on a draft post.') );

   782 

   783 	$user = wp_get_current_user();

   784 	if ( $user->exists() ) {

   785 		$user_ID = $user->ID;

   786 		$comment_author       = wp_slash( $user->display_name );

   787 		$comment_author_email = wp_slash( $user->user_email );

   788 		$comment_author_url   = wp_slash( $user->user_url );

   789 		$comment_content      = trim($_POST['content']);

   790 		if ( current_user_can( 'unfiltered_html' ) ) {

   791 			if ( ! isset( $_POST['_wp_unfiltered_html_comment'] ) )

   792 				$_POST['_wp_unfiltered_html_comment'] = '';

   793 

   794 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {

   795 				kses_remove_filters(); // start with a clean slate

   796 				kses_init_filters(); // set up the filters

   797 			}

   798 		}

   799 	} else {

   800 		wp_die( __( 'Sorry, you must be logged in to reply to a comment.' ) );

   801 	}

   802 

   803 	if ( '' == $comment_content )

   804 		wp_die( __( 'ERROR: please type a comment.' ) );

   805 

   806 	$comment_parent = 0;

   807 	if ( isset( $_POST['comment_ID'] ) )

   808 		$comment_parent = absint( $_POST['comment_ID'] );

   809 	$comment_auto_approved = false;

   810 	$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');

   811 

   812 	// automatically approve parent comment

   813 	if ( !empty($_POST['approve_parent']) ) {

   814 		$parent = get_comment( $comment_parent );

   815 

   816 		if ( $parent && $parent->comment_approved === '0' && $parent->comment_post_ID == $comment_post_ID ) {

   817 			if ( wp_set_comment_status( $parent->comment_ID, 'approve' ) )

   818 				$comment_auto_approved = true;

   819 		}

   820 	}

   821 

   822 	$comment_id = wp_new_comment( $commentdata );

   823 	$comment = get_comment($comment_id);

   824 	if ( ! $comment ) wp_die( 1 );

   825 

   826 	$position = ( isset($_POST['position']) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';

   827 

   828 	ob_start();

   829 	if ( isset( $_REQUEST['mode'] ) && 'dashboard' == $_REQUEST['mode'] ) {

   830 		require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );

   831 		_wp_dashboard_recent_comments_row( $comment );

   832 	} else {

   833 		if ( isset( $_REQUEST['mode'] ) && 'single' == $_REQUEST['mode'] ) {

   834 			$wp_list_table = _get_list_table('WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );

   835 		} else {

   836 			$wp_list_table = _get_list_table('WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );

   837 		}

   838 		$wp_list_table->single_row( $comment );

   839 	}

   840 	$comment_list_item = ob_get_clean();

   841 

   842 	$response =  array(

   843 		'what' => 'comment',

   844 		'id' => $comment->comment_ID,

   845 		'data' => $comment_list_item,

   846 		'position' => $position

   847 	);

   848 

   849 	if ( $comment_auto_approved )

   850 		$response['supplemental'] = array( 'parent_approved' => $parent->comment_ID );

   851 

   852 	$x = new WP_Ajax_Response();

   853 	$x->add( $response );

   854 	$x->send();

   855 }

   856 

   857 function wp_ajax_edit_comment() {

   858 	global $wp_list_table;

   859 

   860 	check_ajax_referer( 'replyto-comment', '_ajax_nonce-replyto-comment' );

   861 

   862 	$comment_id = (int) $_POST['comment_ID'];

   863 	if ( ! current_user_can( 'edit_comment', $comment_id ) )

   864 		wp_die( -1 );

   865 

   866 	if ( '' == $_POST['content'] )

   867 		wp_die( __( 'ERROR: please type a comment.' ) );

   868 

   869 	if ( isset( $_POST['status'] ) )

   870 		$_POST['comment_status'] = $_POST['status'];

   871 	edit_comment();

   872 

   873 	$position = ( isset($_POST['position']) && (int) $_POST['position']) ? (int) $_POST['position'] : '-1';

   874 	$comments_status = isset($_POST['comments_listing']) ? $_POST['comments_listing'] : '';

   875 

   876 	$checkbox = ( isset($_POST['checkbox']) && true == $_POST['checkbox'] ) ? 1 : 0;

   877 	$wp_list_table = _get_list_table( $checkbox ? 'WP_Comments_List_Table' : 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );

   878 

   879 	$comment = get_comment( $comment_id );

   880 	if ( empty( $comment->comment_ID ) )

   881 		wp_die( -1 );

   882 

   883 	ob_start();

   884 	$wp_list_table->single_row( $comment );

   885 	$comment_list_item = ob_get_clean();

   886 

   887 	$x = new WP_Ajax_Response();

   888 

   889 	$x->add( array(

   890 		'what' => 'edit_comment',

   891 		'id' => $comment->comment_ID,

   892 		'data' => $comment_list_item,

   893 		'position' => $position

   894 	));

   895 

   896 	$x->send();

   897 }

   898 

   899 function wp_ajax_add_menu_item() {

   900 	check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );

   901 

   902 	if ( ! current_user_can( 'edit_theme_options' ) )

   903 		wp_die( -1 );

   904 

   905 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';

   906 

   907 	// For performance reasons, we omit some object properties from the checklist.

   908 	// The following is a hacky way to restore them when adding non-custom items.

   909 

   910 	$menu_items_data = array();

   911 	foreach ( (array) $_POST['menu-item'] as $menu_item_data ) {

   912 		if (

   913 			! empty( $menu_item_data['menu-item-type'] ) &&

   914 			'custom' != $menu_item_data['menu-item-type'] &&

   915 			! empty( $menu_item_data['menu-item-object-id'] )

   916 		) {

   917 			switch( $menu_item_data['menu-item-type'] ) {

   918 				case 'post_type' :

   919 					$_object = get_post( $menu_item_data['menu-item-object-id'] );

   920 				break;

   921 

   922 				case 'taxonomy' :

   923 					$_object = get_term( $menu_item_data['menu-item-object-id'], $menu_item_data['menu-item-object'] );

   924 				break;

   925 			}

   926 

   927 			$_menu_items = array_map( 'wp_setup_nav_menu_item', array( $_object ) );

   928 			$_menu_item = array_shift( $_menu_items );

   929 

   930 			// Restore the missing menu item properties

   931 			$menu_item_data['menu-item-description'] = $_menu_item->description;

   932 		}

   933 

   934 		$menu_items_data[] = $menu_item_data;

   935 	}

   936 

   937 	$item_ids = wp_save_nav_menu_items( 0, $menu_items_data );

   938 	if ( is_wp_error( $item_ids ) )

   939 		wp_die( 0 );

   940 

   941 	$menu_items = array();

   942 

   943 	foreach ( (array) $item_ids as $menu_item_id ) {

   944 		$menu_obj = get_post( $menu_item_id );

   945 		if ( ! empty( $menu_obj->ID ) ) {

   946 			$menu_obj = wp_setup_nav_menu_item( $menu_obj );

   947 			$menu_obj->label = $menu_obj->title; // don't show "(pending)" in ajax-added items

   948 			$menu_items[] = $menu_obj;

   949 		}

   950 	}

   951 

   952 	/**

   953 	 * Filter the Walker class used when adding nav menu items.

   954 	 *

   955 	 * @since 3.4.0

   956 	 *

   957 	 * @param string $class   The walker class to use. Default 'Walker_Nav_Menu_Edit'.

   958 	 * @param int    $menu_id The menu id, derived from $_POST['menu'].

   959 	 */

   960 	$walker_class_name = apply_filters( 'wp_edit_nav_menu_walker', 'Walker_Nav_Menu_Edit', $_POST['menu'] );

   961 

   962 	if ( ! class_exists( $walker_class_name ) )

   963 		wp_die( 0 );

   964 

   965 	if ( ! empty( $menu_items ) ) {

   966 		$args = array(

   967 			'after' => '',

   968 			'before' => '',

   969 			'link_after' => '',

   970 			'link_before' => '',

   971 			'walker' => new $walker_class_name,

   972 		);

   973 		echo walk_nav_menu_tree( $menu_items, 0, (object) $args );

   974 	}

   975 	wp_die();

   976 }

   977 

   978 function wp_ajax_add_meta() {

   979 	check_ajax_referer( 'add-meta', '_ajax_nonce-add-meta' );

   980 	$c = 0;

   981 	$pid = (int) $_POST['post_id'];

   982 	$post = get_post( $pid );

   983 

   984 	if ( isset($_POST['metakeyselect']) || isset($_POST['metakeyinput']) ) {

   985 		if ( !current_user_can( 'edit_post', $pid ) )

   986 			wp_die( -1 );

   987 		if ( isset($_POST['metakeyselect']) && '#NONE#' == $_POST['metakeyselect'] && empty($_POST['metakeyinput']) )

   988 			wp_die( 1 );

   989 		if ( $post->post_status == 'auto-draft' ) {

   990 			$save_POST = $_POST; // Backup $_POST

   991 			$_POST = array(); // Make it empty for edit_post()

   992 			$_POST['action'] = 'draft'; // Warning fix

   993 			$_POST['post_ID'] = $pid;

   994 			$_POST['post_type'] = $post->post_type;

   995 			$_POST['post_status'] = 'draft';

   996 			$now = current_time('timestamp', 1);

   997 			$_POST['post_title'] = sprintf( __( 'Draft created on %1$s at %2$s' ), date( get_option( 'date_format' ), $now ), date( get_option( 'time_format' ), $now ) );

   998 

   999 			if ( $pid = edit_post() ) {

  1000 				if ( is_wp_error( $pid ) ) {

  1001 					$x = new WP_Ajax_Response( array(

  1002 						'what' => 'meta',

  1003 						'data' => $pid

  1004 					) );

  1005 					$x->send();

  1006 				}

  1007 				$_POST = $save_POST; // Now we can restore original $_POST again

  1008 				if ( !$mid = add_meta( $pid ) )

  1009 					wp_die( __( 'Please provide a custom field value.' ) );

  1010 			} else {

  1011 				wp_die( 0 );

  1012 			}

  1013 		} else if ( !$mid = add_meta( $pid ) ) {

  1014 			wp_die( __( 'Please provide a custom field value.' ) );

  1015 		}

  1016 

  1017 		$meta = get_metadata_by_mid( 'post', $mid );

  1018 		$pid = (int) $meta->post_id;

  1019 		$meta = get_object_vars( $meta );

  1020 		$x = new WP_Ajax_Response( array(

  1021 			'what' => 'meta',

  1022 			'id' => $mid,

  1023 			'data' => _list_meta_row( $meta, $c ),

  1024 			'position' => 1,

  1025 			'supplemental' => array('postid' => $pid)

  1026 		) );

  1027 	} else { // Update?

  1028 		$mid = (int) key( $_POST['meta'] );

  1029 		$key = wp_unslash( $_POST['meta'][$mid]['key'] );

  1030 		$value = wp_unslash( $_POST['meta'][$mid]['value'] );

  1031 		if ( '' == trim($key) )

  1032 			wp_die( __( 'Please provide a custom field name.' ) );

  1033 		if ( '' == trim($value) )

  1034 			wp_die( __( 'Please provide a custom field value.' ) );

  1035 		if ( ! $meta = get_metadata_by_mid( 'post', $mid ) )

  1036 			wp_die( 0 ); // if meta doesn't exist

  1037 		if ( is_protected_meta( $meta->meta_key, 'post' ) || is_protected_meta( $key, 'post' ) ||

  1038 			! current_user_can( 'edit_post_meta', $meta->post_id, $meta->meta_key ) ||

  1039 			! current_user_can( 'edit_post_meta', $meta->post_id, $key ) )

  1040 			wp_die( -1 );

  1041 		if ( $meta->meta_value != $value || $meta->meta_key != $key ) {

  1042 			if ( !$u = update_metadata_by_mid( 'post', $mid, $value, $key ) )

  1043 				wp_die( 0 ); // We know meta exists; we also know it's unchanged (or DB error, in which case there are bigger problems).

  1044 		}

  1045 

  1046 		$x = new WP_Ajax_Response( array(

  1047 			'what' => 'meta',

  1048 			'id' => $mid, 'old_id' => $mid,

  1049 			'data' => _list_meta_row( array(

  1050 				'meta_key' => $key,

  1051 				'meta_value' => $value,

  1052 				'meta_id' => $mid

  1053 			), $c ),

  1054 			'position' => 0,

  1055 			'supplemental' => array('postid' => $meta->post_id)

  1056 		) );

  1057 	}

  1058 	$x->send();

  1059 }

  1060 

  1061 function wp_ajax_add_user( $action ) {

  1062 	global $wp_list_table;

  1063 	if ( empty( $action ) )

  1064 		$action = 'add-user';

  1065 

  1066 	check_ajax_referer( $action );

  1067 	if ( ! current_user_can('create_users') )

  1068 		wp_die( -1 );

  1069 	if ( ! $user_id = edit_user() ) {

  1070 		wp_die( 0 );

  1071 	} elseif ( is_wp_error( $user_id ) ) {

  1072 		$x = new WP_Ajax_Response( array(

  1073 			'what' => 'user',

  1074 			'id' => $user_id

  1075 		) );

  1076 		$x->send();

  1077 	}

  1078 	$user_object = get_userdata( $user_id );

  1079 

  1080 	$wp_list_table = _get_list_table('WP_Users_List_Table');

  1081 

  1082 	$role = current( $user_object->roles );

  1083 

  1084 	$x = new WP_Ajax_Response( array(

  1085 		'what' => 'user',

  1086 		'id' => $user_id,

  1087 		'data' => $wp_list_table->single_row( $user_object, '', $role ),

  1088 		'supplemental' => array(

  1089 			'show-link' => sprintf(__( 'User <a href="#%s">%s</a> added' ), "user-$user_id", $user_object->user_login),

  1090 			'role' => $role,

  1091 		)

  1092 	) );

  1093 	$x->send();

  1094 }

  1095 

  1096 function wp_ajax_autosave() {

  1097 	define( 'DOING_AUTOSAVE', true );

  1098 

  1099 	check_ajax_referer( 'autosave', 'autosavenonce' );

  1100 

  1101 	if ( ! empty( $_POST['catslist'] ) )

  1102 		$_POST['post_category'] = explode( ',', $_POST['catslist'] );

  1103 	if ( $_POST['post_type'] == 'page' || empty( $_POST['post_category'] ) )

  1104 		unset( $_POST['post_category'] );

  1105 

  1106 	$data = '';

  1107 	$supplemental = array();

  1108 	$id = $revision_id = 0;

  1109 

  1110 	$post_id = (int) $_POST['post_id'];

  1111 	$_POST['ID'] = $_POST['post_ID'] = $post_id;

  1112 	$post = get_post( $post_id );

  1113 	if ( empty( $post->ID ) || ! current_user_can( 'edit_post', $post->ID ) )

  1114 		wp_die( __( 'You are not allowed to edit this post.' ) );

  1115 

  1116 	if ( 'page' == $post->post_type && ! current_user_can( 'edit_page', $post->ID ) )

  1117 		wp_die( __( 'You are not allowed to edit this page.' ) );

  1118 

  1119 	if ( 'auto-draft' == $post->post_status )

  1120 		$_POST['post_status'] = 'draft';

  1121 

  1122 	if ( ! empty( $_POST['autosave'] ) ) {

  1123 		if ( ! wp_check_post_lock( $post->ID ) && get_current_user_id() == $post->post_author && ( 'auto-draft' == $post->post_status || 'draft' == $post->post_status ) ) {

  1124 			// Drafts and auto-drafts are just overwritten by autosave for the same user if the post is not locked

  1125 			$id = edit_post();

  1126 		} else {

  1127 			// Non drafts or other users drafts are not overwritten. The autosave is stored in a special post revision for each user.

  1128 			$revision_id = wp_create_post_autosave( $post->ID );

  1129 			if ( is_wp_error($revision_id) )

  1130 				$id = $revision_id;

  1131 			else

  1132 				$id = $post->ID;

  1133 		}

  1134 

  1135 		if ( ! is_wp_error($id) ) {