Ticket #20770: 20770.2.diff

wp-includes/pluggable.php

@@ -831 +831 @@
  *
  * @param string $action Action nonce
  * @param string $query_arg where to look for nonce in $_REQUEST (since 2.5)
+ * @param bool $die Die if checking fails
+ * @param bool $renonce If checking succeeds, calculate a new nonce and send it as an X-WP-nonce header
  */
-function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
+function check_ajax_referer( $action = -1, $query_arg = false, $die = true, $renonce = false ) {
         if ( $query_arg )
                 $nonce = $_REQUEST[$query_arg];
         else
@@ -849 +851 @@
 
         do_action('check_ajax_referer', $action, $result);
 
+        if ( $renonce && !headers_sent() )
+                header( 'X-WP-nonce: ' . $action . '=' . wp_create_nonce( $action ) );
+        
         return $result;
 }
 endif;

wp-includes/script-loader.php

@@ -373 +373 @@
                 $scripts->add( 'admin-gallery', "/wp-admin/js/gallery$suffix.js", array( 'jquery-ui-sortable' ) );
 
                 $scripts->add( 'admin-widgets', "/wp-admin/js/widgets$suffix.js", array( 'jquery-ui-sortable', 'jquery-ui-draggable', 'jquery-ui-droppable' ), false, 1 );
+                $scripts->localize( 'admin-widgets', 'widgetsL10n', array(
+                        'loggedOut' => __('You are logged out!')
+                ));
 
                 $scripts->add( 'theme', "/wp-admin/js/theme$suffix.js", array( 'jquery' ), false, 1 );
 

wp-admin/includes/ajax-actions.php

@@ -1510 +1510 @@
 }
 
 function wp_ajax_widgets_order() {
-        check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
+        check_ajax_referer( 'save-sidebar-widgets', 'savewidgets', true, true );
 
         if ( !current_user_can('edit_theme_options') )
                 wp_die( -1 );
@@ -1543 +1543 @@
 function wp_ajax_save_widget() {
         global $wp_registered_widgets, $wp_registered_widget_controls, $wp_registered_widget_updates;
 
-        check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
+        check_ajax_referer( 'save-sidebar-widgets', 'savewidgets', true, true );
 
         if ( !current_user_can('edit_theme_options') || !isset($_POST['id_base']) )
                 wp_die( -1 );

wp-admin/js/widgets.dev.js

@@ -189 +189 @@
                                 a['sidebars[' + $(this).attr('id') + ']'] = $(this).sortable('toArray').join(',');
                 });
 
-                $.post( ajaxurl, a, function() {
+                var xhr = $.post( ajaxurl, a, function() {
                         $('img.ajax-feedback').css('visibility', 'hidden');
+                        nonce_header = xhr.getResponseHeader("X-WP-nonce");
+                        nonce = nonce_header.split("=", 2)[1];
+                        $('#_wpnonce_widgets').val(nonce);
                 });
 
                 this.resize();
@@ -212 +215 @@
 
                 data += '&' + $.param(a);
 
-                $.post( ajaxurl, data, function(r){
+                var xhr = $.post( ajaxurl, data, function(r){
                         var id;
 
+                        if ( "0" === r ) {
+                                logout_message = $('.logout-message', widget)
+                                if ( !logout_message.length ) {
+                                        $('img.ajax-feedback', widget).parent().parent().append($('<div class="error logout-message"><p>' + widgetsL10n.loggedOut + '</p></div>'));
+                                }
+                                $('.ajax-feedback', widget).css('visibility', 'hidden');
+                                logout_message.fadeOut(50).fadeIn(500);
+                                return false;
+                        }
+
                         if ( del ) {
                                 if ( !$('input.widget_number', widget).val() ) {
                                         id = $('input.widget-id', widget).val();
@@ -236 +249 @@
                                 }
                         } else {
                                 $('.ajax-feedback').css('visibility', 'hidden');
+                                $('.logout-message', widget).hide();
                                 if ( r && r.length > 2 ) {
                                         $('div.widget-content', widget).html(r);
                                         wpWidgets.appendTitle(widget);
                                         wpWidgets.fixLabels(widget);
                                 }
                         }
-                        if ( order )
+                        if ( order ) {
                                 wpWidgets.saveOrder();
+                        } else {
+                                nonce_header = xhr.getResponseHeader("X-WP-nonce");
+                                nonce = nonce_header.split("=", 2)[1];
+                                $('#_wpnonce_widgets').val(nonce);
+                        }
                 });
         },
 

wp-admin/css/wp-admin.dev.css

@@ -7883 +7883 @@
         display: block;
 }
 
-.widget .widget-inside p {
+.widget-inside p {
         margin: 0 0 1em;
         padding: 0;
 }