diff --git a/wp-admin/post.php b/wp-admin/post.php
index 750990554..c945be13c 100644
--- a/wp-admin/post.php
+++ b/wp-admin/post.php
@@ -23,7 +23,8 @@ $action = "delete";
 
 switch($action) {
 case 'post':
-
+	check_admin_referer();
+	
 	$post_ID = write_post();
 
 	// Redirect.
@@ -92,6 +93,8 @@ case 'editattachment':
 		add_post_meta($post_id, '_wp_attachment_metadata', $newmeta);
 
 case 'editpost':
+	check_admin_referer();
+	
 	$post_ID = edit_post();
 
 	if ($_POST['save']) {