Ticket #31897: 31897.2.diff

src/wp-admin/customize.php

@@ -55 +55 @@
 wp_enqueue_script( 'customize-controls' );
 wp_enqueue_style( 'customize-controls' );
 
+// Setup heartbeat to keep nonces up to date.
+wp_enqueue_script( 'heartbeat' );
+
 /**
  * Enqueue Customizer control scripts.
  *

src/wp-admin/js/customize-controls.js

@@ -2946 +2946 @@
                                 active: $.Deferred()
                         };
 
+                        // When the heartbeat returns a refreshed nonce array, apply it.
+                        $( document ).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
+                                if ( 'undefined' !== typeof data['wp-refresh-customizer-nonce'] ) {
+                                        api.trigger( 'nonce-refresh', data['wp-refresh-customizer-nonce'] );
+                                }
+                        } );
+
+                        // Attach our existing nonce to the heartbeat request, so it can be checked for expiration.
+                        $( document ).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
+                                data['wp-refresh-customizer-nonce'] = api.settings.nonce;
+                                data['isCustomizer']                = 'on';
+                        } );
+
                         /*
                          * Wrap this.refresh to prevent it from hammering the servers:
                          *

src/wp-includes/class-wp-customize-manager.php

@@ -304 +304 @@
 
                 // Export the settings to JS via the _wpCustomizeSettings variable.
                 add_action( 'customize_controls_print_footer_scripts', array( $this, 'customize_pane_settings' ), 1000 );
+
+                // Customizer hooks: refresh the customizer nonces using the hearbeat api.
+                add_filter( 'heartbeat_received', array( $this, 'wp_refresh_customizer_nonces' ), 10,  3 );
+
         }
 
         /**
+         * Return refreshed customizer nonces when needed.
+         *
+         * @since 4.5.0
+                 */
+        function wp_refresh_customizer_nonces( $response, $data, $screen_id ) {
+                if ( array_key_exists( 'wp-refresh-customizer-nonce', $data ) ) {
+                        $received = $data['wp-refresh-customizer-nonce'];
+                        if ( 2 === wp_verify_nonce( $received['save'], 'save-customize_' . $this->get_stylesheet() ) ) {
+                                $response['wp-refresh-customizer-nonce'] = $this->get_nonces();
+                        }
+                }
+
+                return $response;
+        }
+
+        /**
          * Return true if it's an AJAX request.
          *
          * @since 3.4.0

src/wp-includes/js/heartbeat.js

@@ -364 +364 @@
                                 _nonce: typeof window.heartbeatSettings === 'object' ? window.heartbeatSettings.nonce : '',
                                 action: 'heartbeat',
                                 screen_id: settings.screenId,
-                                has_focus: settings.hasFocus
+                                has_focus: settings.hasFocus,
+                                wp_customize: heartbeatData.isCustomizer
                         };
 
                         settings.connecting = true;