Ticket #24169: 24169.patch

wp-includes/class-wp-customize-manager.php

@@ -34 +34 @@
 
                 add_filter( 'wp_die_handler', array( $this, 'wp_die_handler' ) );
 
+                add_action( 'init',         array( $this, 'init'        ) );
                 add_action( 'setup_theme',  array( $this, 'setup_theme' ) );
-                add_action( 'wp_loaded',    array( $this, 'wp_loaded' ) );
+                add_action( 'wp_loaded',    array( $this, 'wp_loaded'   ) );
 
                 // Run wp_redirect_status late to make sure we override the status last.
                 add_action( 'wp_redirect_status', array( $this, 'wp_redirect_status' ), 1000 );
@@ -111 +112 @@
 
                 if ( is_admin() && ! $this->doing_ajax() )
                     auth_redirect();
-                elseif ( $this->doing_ajax() && ! is_user_logged_in() )
-                    $this->wp_die( 0 );
 
                 show_admin_bar( false );
 
-                if ( ! current_user_can( 'edit_theme_options' ) )
-                        $this->wp_die( -1 );
-
                 $this->original_stylesheet = get_stylesheet();
+                $this->theme               = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
 
-                $this->theme = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
-
+                // Once the theme is loaded, we'll validate it.
                 if ( $this->is_theme_active() ) {
-                        // Once the theme is loaded, we'll validate it.
                         add_action( 'after_setup_theme', array( $this, 'after_setup_theme' ) );
                 } else {
-                        if ( ! current_user_can( 'switch_themes' ) )
-                                $this->wp_die( -1 );
 
-                        // If the theme isn't active, you can't preview it if it is not allowed or has errors.
+                        // Bail if theme has errors
                         if ( $this->theme()->errors() )
                                 $this->wp_die( -1 );
 
-                        if ( ! $this->theme()->is_allowed() )
+                        // Bail if theme is not allowed
+                        if ( !$this->theme()->is_allowed() )
                                 $this->wp_die( -1 );
                 }
 
+
                 $this->start_previewing_theme();
         }
 
@@ -154 +149 @@
         }
 
         /**
+         * Callback to perform capability checks on the current user, once
+         * wp_get_current_user() has been called.
+         *
+         * @since 3.6
+         */
+        function init() {
+
+                // Bail if user is not logged in
+                if ( $this->doing_ajax() && ! is_user_logged_in() ) {
+                    $this->wp_die( 0 );
+                }
+
+                // Bail if user cannot edit theme options
+                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                        $this->wp_die( -1 );
+                }
+
+                // Previewing a new theme
+                if ( ! $this->is_theme_active() ) {
+
+                        // Bail if user cannot switch themes
+                        if ( ! current_user_can( 'switch_themes' ) ) {
+                                $this->wp_die( -1 );
+                        }
+                }
+        }
+
+        /**
          * Start previewing the selected theme.
          *
          * Adds filters to change the current theme.