Commit 82c3093a19 for wordpress.org

commit 82c3093a197b5b7cb9d8846d2fa2670b5f98391e
Author: adamsilverstein <adamsilverstein@git.wordpress.org>
Date:   Thu Sep 17 17:40:12 2026 +0000

    Administration: Add authorization check to `wp_ajax_sample_permalink()`.

    Props peterwilsoncc, westonruter, jorbin.

    Built from https://develop.svn.wordpress.org/trunk@63669


    git-svn-id: http://core.svn.wordpress.org/trunk@62843 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index 126b6b75d4..c05633428a 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -2059,6 +2059,13 @@ function wp_ajax_menu_quick_search() {
 function wp_ajax_get_permalink() {
 	check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
 	$post_id = isset( $_POST['post_id'] ) ? (int) $_POST['post_id'] : 0;
+	if ( ! $post_id ) {
+		// Bypass call to get_preview_post_link() for unspecified post ID.
+		wp_die( '' );
+	}
+	if ( ! current_user_can( 'edit_post', $post_id ) ) {
+		wp_die( -1 );
+	}
 	wp_die( get_preview_post_link( $post_id ) );
 }

@@ -2070,8 +2077,15 @@ function wp_ajax_get_permalink() {
 function wp_ajax_sample_permalink() {
 	check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
 	$post_id = isset( $_POST['post_id'] ) ? (int) $_POST['post_id'] : 0;
-	$title   = $_POST['new_title'] ?? '';
-	$slug    = $_POST['new_slug'] ?? null;
+	if ( ! $post_id ) {
+		// Bypass call to get_sample_permalink_html() for unspecified post ID.
+		wp_die( '' );
+	}
+	if ( ! current_user_can( 'edit_post', $post_id ) ) {
+		wp_die( -1 );
+	}
+	$title = $_POST['new_title'] ?? '';
+	$slug  = $_POST['new_slug'] ?? null;
 	wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
 }

diff --git a/wp-includes/version.php b/wp-includes/version.php
index edd993a416..82cd682c6c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63665';
+$wp_version = '7.2-alpha-63669';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.