Ticket #31294: 31294.3.diff

src/wp-admin/customize.php

@@ -216 +216 @@
 
         $login_url = add_query_arg( array(
                 'interim-login' => 1,
-                'customize-login' => 1
+                'customize-login' => 1,
+                'theme' => $wp_customize->get_stylesheet(),
         ), wp_login_url() );
 
         // Prepare Customizer settings to pass to JavaScript.

src/wp-admin/js/customize-controls.js

@@ -2358 +2358 @@
 
                         messenger.targetWindow( iframe[0].contentWindow );
 
-                        messenger.bind( 'login', function() {
+                        messenger.bind( 'login', function ( params ) {
+                                api.trigger( 'nonce-refresh', params.nonce );
+
                                 iframe.remove();
                                 messenger.destroy();
                                 delete previewer._login;
@@ -2538 +2540 @@
                         $.extend( this.nonce, nonce );
                 });
 
+                // Refresh the nonces if login sends updated nonces over.
+                api.bind( 'nonce-refresh', function( nonce ) {
+                        $.extend( api.settings.nonce, nonce );
+                        $.extend( api.previewer.nonce, nonce );
+                });
+
                 // Create Settings
                 $.each( api.settings.settings, function( id, data ) {
                         api.create( id, id, data.value, {

src/wp-admin/js/customize-widgets.js

@@ -1898 +1898 @@
                 sidebar_widgets: api.Widgets.SidebarControl
         });
 
+        // Refresh the nonces if login sends updated nonces over.
+        api.bind( 'nonce-refresh', function( nonce ) {
+                api.Widgets.data.nonce = nonce['update-widget'];
+        });
+
         /**
          * Init Customizer for widgets.
          */

src/wp-login.php

@@ -767 +767 @@
 default:
         $secure_cookie = '';
         $customize_login = isset( $_REQUEST['customize-login'] );
-        if ( $customize_login )
+        $customize_theme = null;
+        if ( $customize_login ) {
                 wp_enqueue_script( 'customize-base' );
+                if ( ! empty( $_REQUEST['theme'] ) ) {
+                        $customize_theme = wp_unslash( $_REQUEST['theme'] );
+                }
+        }
 
         // If the user wants ssl but the session is not ssl, force a secure cookie.
         if ( !empty($_POST['log']) && !force_ssl_admin() ) {
@@ -792 +797 @@
 
         $reauth = empty($_REQUEST['reauth']) ? false : true;
 
+        $GLOBALS['_wp_login_logged_in_cookie'] = null;
+
+        /**
+         * Workaround to obtain the LOGGED_IN_COOKIE when wp_signon() is called.
+         *
+         * @ignore
+         * @since 4.2.0
+         *
+         * @param string $cookie The logged-in cookie.
+         */
+        function _capture_wp_login_logged_in_cookie( $cookie ) {
+                $GLOBALS['_wp_login_logged_in_cookie'] = $cookie;
+        }
+
+        add_action( 'set_logged_in_cookie', '_capture_wp_login_logged_in_cookie' );
         $user = wp_signon( '', $secure_cookie );
+        remove_action( 'set_logged_in_cookie', '_capture_wp_login_logged_in_cookie' );
 
         if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {
                 if ( headers_sent() ) {
@@ -827 +848 @@
                         /** This action is documented in wp-login.php */
                         do_action( 'login_footer' ); ?>
                         <?php if ( $customize_login ) : ?>
-                                <script type="text/javascript">setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
+                                <?php
+                                $theme = wp_get_theme( $customize_theme );
+                                $messenger_login_params = array(
+                                        'url' => wp_customize_url(),
+                                        'channel' => 'login',
+                                );
+                                $login_message = array();
+
+                                // Update Customizer nonces
+                                if ( ! $theme->errors() ) {
+                                        /*
+                                         * Set the current user and auth cookie so that wp_create_nonce() will succeed;
+                                         * wp_signon() calls wp_set_auth_cookie() which does not set $_COOKIE, and
+                                         * wp_create_nonce() calls wp_get_session_token() which calls wp_parse_auth_cookie()
+                                         * which expects the $_COOKIE to be set.
+                                         */
+                                        wp_set_current_user( $user->ID );
+                                        $_COOKIE[ LOGGED_IN_COOKIE ] = $GLOBALS['_wp_login_logged_in_cookie'];
+                                        $login_message['nonce'] = array(
+                                                'save' => wp_create_nonce( 'save-customize_' . $theme->get_stylesheet() ),
+                                                'preview' => wp_create_nonce( 'preview-customize_' . $theme->get_stylesheet() ),
+                                                'update-widget' => wp_create_nonce( 'update-widget' ),
+                                        );
+                                }
+
+                                ?>
+                                <script type="text/javascript">
+                                        setTimeout( function () {
+                                                var messenger = new wp.customize.Messenger( <?php echo wp_json_encode( $messenger_login_params ); ?> );
+                                                messenger.send( 'login', <?php echo wp_json_encode( $login_message ); ?> );
+                                        }, 1000 );
+                                </script>
                         <?php endif; ?>
                         </body></html>
 <?php           exit;
@@ -924 +976 @@
 <?php   } ?>
 <?php   if ( $customize_login ) : ?>
                 <input type="hidden" name="customize-login" value="1" />
+                <input type="hidden" name="theme" value="<?php echo esc_attr( $customize_theme ) ?>" />
 <?php   endif; ?>
                 <input type="hidden" name="testcookie" value="1" />
         </p>