Ticket #24447: 24447.2.patch

src/wp-admin/includes/admin-filters.php

@@ -58 +58 @@
 
 add_filter( 'heartbeat_received', 'wp_check_locked_posts',  10,  3 );
 add_filter( 'heartbeat_received', 'wp_refresh_post_lock',   10,  3 );
-add_filter( 'heartbeat_received', 'wp_refresh_post_nonces', 10,  3 );
 add_filter( 'heartbeat_received', 'heartbeat_autosave',     500, 2 );
 
 add_filter( 'heartbeat_settings', 'wp_heartbeat_set_suspension' );

src/wp-admin/includes/ajax-actions.php

@@ -2571 +2571 @@
  * @since 3.6.0
  */
 function wp_ajax_heartbeat() {
-        if ( empty( $_POST['_nonce'] ) )
+        if ( empty( $_POST['_nonce'] ) ) {
                 wp_send_json_error();
+        }
 
-        $response = array();
+        $response = $data = array();
+        $nonce_state = wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' );
+        $nonces = explode( ',', $_POST['nonces'] );
+        $screen_id = empty( $_POST['screen_id'] ) ? 'front' : sanitize_key( $_POST['screen_id'] );
 
-        if ( false === wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' ) ) {
-                // User is logged in but nonces have expired.
-                $response['nonces_expired'] = true;
-                wp_send_json($response);
+        if ( ! empty( $_POST['data'] ) ) {
+                $data = wp_unslash( (array) $_POST['data'] );
         }
 
-        // screen_id is the same as $current_screen->id and the JS global 'pagenow'.
-        if ( ! empty($_POST['screen_id']) )
-                $screen_id = sanitize_key($_POST['screen_id']);
-        else
-                $screen_id = 'front';
+        // Send the current time according to the server.
+        $response['server_time'] = time();
+
+        // We're halfway the nonces' life, so refresh them.
+        if ( 1 !== $nonce_state ) {
+                if ( ! empty( $nonces ) ) {
+                        $response['nonces'] = array();
 
-        if ( ! empty($_POST['data']) ) {
-                $data = wp_unslash( (array) $_POST['data'] );
+                        foreach ( $nonces as $action ) {
+                                $response['nonces'][ $action ] = wp_create_nonce( $action );
+                        }
+                }
+
+                // If nonces expired, do not send anything else.
+                if ( false === $nonce_state ) {
+                        wp_send_json( $response );
+                }
+        }
 
+        if ( ! empty( $data ) ) {
                 /**
                  * Filter the Heartbeat response received.
                  *
@@ -2625 +2638 @@
          */
         do_action( 'heartbeat_tick', $response, $screen_id );
 
-        // Send the current time according to the server
-        $response['server_time'] = time();
-
-        wp_send_json($response);
+        wp_send_json( $response );
 }
 
 /**

src/wp-admin/includes/misc.php

@@ -762 +762 @@
 }
 
 /**
- * Check nonce expiration on the New/Edit Post screen and refresh if needed
- *
- * @since 3.6.0
- */
-function wp_refresh_post_nonces( $response, $data, $screen_id ) {
-        if ( array_key_exists( 'wp-refresh-post-nonces', $data ) ) {
-                $received = $data['wp-refresh-post-nonces'];
-                $response['wp-refresh-post-nonces'] = array( 'check' => 1 );
-
-                if ( ! $post_id = absint( $received['post_id'] ) )
-                        return $response;
-
-                if ( ! current_user_can( 'edit_post', $post_id ) || empty( $received['post_nonce'] ) )
-                        return $response;
-
-                if ( 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
-                        $response['wp-refresh-post-nonces'] = array(
-                                'replace' => array(
-                                        'getpermalinknonce' => wp_create_nonce('getpermalink'),
-                                        'samplepermalinknonce' => wp_create_nonce('samplepermalink'),
-                                        'closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
-                                        '_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
-                                        '_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
-                                ),
-                                'heartbeatNonce' => wp_create_nonce( 'heartbeat-nonce' ),
-                        );
-                }
-        }
-
-        return $response;
-}
-
-/**
  * Disable suspension of Heartbeat on the Add/Edit Post screens.
  *
  * @since 3.8.0

src/wp-admin/js/post.js

@@ -160 +160 @@
 
 }(jQuery));
 
-(function($) {
-        var check, timeout;
-
-        function schedule() {
-                check = false;
-                window.clearTimeout( timeout );
-                timeout = window.setTimeout( function(){ check = true; }, 300000 );
-        }
-
-        $(document).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
-                var nonce, post_id;
-
-                if ( check ) {
-                        if ( ( post_id = $('#post_ID').val() ) && ( nonce = $('#_wpnonce').val() ) ) {
-                                data['wp-refresh-post-nonces'] = {
-                                        post_id: post_id,
-                                        post_nonce: nonce
-                                };
-                        }
-                }
-        }).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
-                var nonces = data['wp-refresh-post-nonces'];
-
-                if ( nonces ) {
-                        schedule();
-
-                        if ( nonces.replace ) {
-                                $.each( nonces.replace, function( selector, value ) {
-                                        $( '#' + selector ).val( value );
-                                });
-                        }
-
-                        if ( nonces.heartbeatNonce )
-                                window.heartbeatSettings.nonce = nonces.heartbeatNonce;
-                }
-        }).ready( function() {
-                schedule();
-        });
-}(jQuery));
-
 jQuery(document).ready( function($) {
         var stamp, visibility, $submitButtons, updateVisibility, updateText,
                 sticky = '',

src/wp-includes/functions.php

@@ -1380 +1380 @@
  */
 function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
         $name = esc_attr( $name );
-        $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
+        $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" data-nonce-action="' . $action . '" value="' . wp_create_nonce( $action ) . '" />';
 
         if ( $referer )
                 $nonce_field .= wp_referer_field( false );

src/wp-includes/js/heartbeat.js

@@ -342 +342 @@
                  * @return void
                  */
                 function connect() {
-                        var ajaxData, heartbeatData;
+                        var ajaxData, heartbeatData,
+                                nonces = [ 'heartbeat-nonce' ];
 
                         // If the connection to the server is slower than the interval,
                         // heartbeat connects as soon as the previous connection's response is received.
@@ -358 +359 @@
 
                         $document.trigger( 'heartbeat-send', [ heartbeatData ] );
 
+                        $( 'input[data-nonce-action]' ).each( function() {
+                                nonces.push( $( this ).attr( 'data-nonce-action' ) );
+                        } );
+
+                        $document.trigger( 'heartbeat-send-nonces', [ nonces ] );
+
                         ajaxData = {
                                 data: heartbeatData,
                                 interval: settings.tempInterval ? settings.tempInterval / 1000 : settings.mainInterval / 1000,
                                 _nonce: typeof window.heartbeatSettings === 'object' ? window.heartbeatSettings.nonce : '',
                                 action: 'heartbeat',
                                 screen_id: settings.screenId,
-                                has_focus: settings.hasFocus
+                                has_focus: settings.hasFocus,
+                                nonces: nonces.join( ',' )
                         };
 
                         settings.connecting = true;
@@ -387 +395 @@
 
                                 clearErrorState();
 
-                                if ( response.nonces_expired ) {
-                                        $document.trigger( 'heartbeat-nonces-expired' );
-                                        return;
+                                if ( response.nonces ) {
+                                        window.heartbeatSettings.nonce = response.nonces['heartbeat-nonce'];
+
+                                        $.each( response.nonces, function( action, value ) {
+                                                $( 'input[data-nonce-action="' + action + '"]' ).val( value );
+                                        } );
+
+                                        $document.trigger( 'heartbeat-receive-nonces', [ response.nonces ] );
+
+                                        delete response.nonces;
                                 }
 
                                 // Change the interval from PHP