Ticket #27639: 27581.patch

src/wp-admin/admin-ajax.php

@@ -58 +58 @@
         'wp-remove-post-lock', 'dismiss-wp-pointer', 'upload-attachment', 'get-attachment',
         'query-attachments', 'save-attachment', 'save-attachment-compat', 'send-link-to-editor',
         'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs',
-        'save-user-color-scheme', 'update-widget',
+        'save-user-color-scheme', 'update-widget', 'query-themes'
 );
 
 // Register core Ajax calls.

src/wp-admin/includes/ajax-actions.php

@@ -2204 +2204 @@
         update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
         wp_send_json_success();
 }
+
+/**
+ * Perform a query_themes lookup on api.wordpress.org.
+ *
+ * @since x.x.x
+ */
+function wp_ajax_query_themes() {
+        $url = 'http://api.wordpress.org/themes/info/1.1/?action=query_themes';
+
+        check_ajax_referer( 'query-themes', 'nonce' );
+
+        $query_themes_cache_key = md5( serialize( $_POST['api'] ) );
+
+        if ( false === ( $json = get_transient( $query_themes_cache_key ) ) ) {
+                $request = wp_remote_post( $url, array(
+                        'body' => wp_unslash( $_POST['api'] ),
+                ) );
+
+                if ( is_wp_error( $request ) ) {
+                        wp_send_json_error();
+                }
+                if ( 200 != wp_remote_retrieve_response_code( $request ) ) {
+                        wp_send_json_error();
+                }
+
+                $json = json_decode( wp_remote_retrieve_body( $request ) );
+
+                if ( !$json ) {
+                        wp_send_json_error();
+                }
+
+                set_transient( $query_themes_cache_key, $json, 5 * MINUTE_IN_SECONDS );
+        }
+        wp_send_json_success( $json );
+
+}
+ No newline at end of file

src/wp-admin/js/theme.js

@@ -251 +251 @@
 
                 // Otherwise, send a new API call and add it to the cache.
                 if ( ! query && ! isPaginated ) {
-                        query = this.apiCall( request ).done( function( data ) {
+                        query = this.apiCall( request ).done( function( response ) {
+                                data = response.data;
                                 // Update the collection with the queried data.
                                 self.reset( data.themes );
                                 count = data.info.results;
@@ -273 +274 @@
                 } else {
                         // If it's a paginated request we need to fetch more themes...
                         if ( isPaginated ) {
-                                return this.apiCall( request, isPaginated ).done( function( data ) {
+                                return this.apiCall( request, isPaginated ).done( function( response ) {
+                                        data = response.data;
+
                                         // Add the new themes to the current collection
                                         // @todo update counter
                                         self.add( data.themes );
@@ -322 +325 @@
 
                 // Ajax request to .org API
                 return $.ajax({
-                        url: 'https://api.wordpress.org/themes/info/1.1/?action=query_themes',
+                        url: ajaxurl,
 
                         // We want JSON data
                         dataType: 'json',
                         type: 'POST',
-                        crossDomain: true,
 
                         // Request data
                         data: {
-                                action: 'query_themes',
-                                request: _.extend({
-                                        per_page: 72,
-                                        fields: {
-                                                description: true,
-                                                tested: true,
-                                                requires: true,
-                                                rating: true,
-                                                downloaded: true,
-                                                downloadLink: true,
-                                                last_updated: true,
-                                                homepage: true,
-                                                num_ratings: true
-                                        }
-                                }, request)
+                                action: 'query-themes',
+                                nonce: themes.data.settings._nonceQuery,
+                                api: {
+                                        action: 'query_themes',
+                                        request: _.extend({
+                                                per_page: 72,
+                                                fields: {
+                                                        description: true,
+                                                        tested: true,
+                                                        requires: true,
+                                                        rating: true,
+                                                        downloaded: true,
+                                                        downloadLink: true,
+                                                        last_updated: true,
+                                                        homepage: true,
+                                                        num_ratings: true
+                                                }
+                                        }, request)
+                                }
                         },
 
                         beforeSend: function() {

src/wp-admin/theme-install.php

@@ -41 +41 @@
                 'installURI'    => current_user_can( 'install_themes' ) ? self_admin_url( 'theme-install.php' ) : null,
                 'adminUrl'      => parse_url( self_admin_url(), PHP_URL_PATH ),
                 'updateURI'     => self_admin_url( 'update.php' ),
-                '_nonceInstall' => wp_create_nonce( 'install-theme' )
+                '_nonceInstall' => wp_create_nonce( 'install-theme' ),
+                '_nonceQuery'   => wp_create_nonce( 'query-themes' ),
         ),
         'l10n' => array(
                 'addNew' => __( 'Add New Theme' ),