Ticket #22589: 22589.3.diff

src/wp-admin/admin-header.php

@@ -72 +72 @@
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
+<?php if ( is_network_admin() ) : ?>
+        networkajaxurl = '<?php echo network_admin_url( 'admin-ajax.php', 'relative' ); ?>',
+<?php endif; ?>
         pagenow = '<?php echo $current_screen->id; ?>',
         typenow = '<?php echo $current_screen->post_type; ?>',
         adminpage = '<?php echo $admin_body_class; ?>',

src/wp-admin/network/admin-ajax.php

@@ +1 @@
+<?php
+/**
+ * WordPress Network AJAX Process Execution.
+ *
+ * @package WordPress
+ * @subpackage Multisite
+ *
+ * @link https://codex.wordpress.org/AJAX_in_Plugins
+ */
+
+/**
+ * Executing network AJAX process.
+ *
+ * @since 4.6.0
+ */
+define( 'DOING_AJAX', true );
+if ( ! defined( 'WP_NETWORK_ADMIN' ) ) {
+        define( 'WP_NETWORK_ADMIN', true );
+}
+
+// Load WordPress Bootstrap.
+require_once( dirname( dirname( dirname( __FILE__ ) ) ) . '/wp-load.php' );
+
+// Allow for cross-domain requests (from the front end).
+send_origin_headers();
+
+if ( ! is_multisite() ) {
+        die( '0' );
+}
+
+// Require an action parameter.
+if ( empty( $_REQUEST['action'] ) ) {
+        die( '0' );
+}
+
+// Load WordPress Administration APIs.
+require_once( ABSPATH . 'wp-admin/includes/admin.php' );
+
+@header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
+@header( 'X-Robots-Tag: noindex' );
+
+send_nosniff_header();
+nocache_headers();
+
+/** This action is documented in wp-admin/admin.php */
+do_action( 'admin_init' );
+
+if ( is_user_logged_in() ) {
+        /**
+         * Fires authenticated network AJAX actions for logged-in users.
+         *
+         * The dynamic portion of the hook name, `$_REQUEST['action']`,
+         * refers to the name of the AJAX action callback being fired.
+         *
+         * @since 4.6.0
+         */
+        do_action( 'wp_network_ajax_' . $_REQUEST['action'] );
+} else {
+        /**
+         * Fires non-authenticated network AJAX actions for logged-out users.
+         *
+         * The dynamic portion of the hook name, `$_REQUEST['action']`,
+         * refers to the name of the AJAX action callback being fired.
+         *
+         * @since 4.6.0
+         */
+        do_action( 'wp_network_ajax_nopriv_' . $_REQUEST['action'] );
+}
+// Default status.
+die( '0' );