Ticket #31897: 31897.3.diff

src/wp-admin/customize.php

@@ -55 +55 @@
 wp_enqueue_script( 'customize-controls' );
 wp_enqueue_style( 'customize-controls' );
 
+// Setup heartbeat to keep nonces up to date.
+wp_enqueue_script( 'heartbeat' );
+
 /**
  * Enqueue Customizer control scripts.
  *

src/wp-admin/js/customize-controls.js

@@ -2946 +2946 @@
                                 active: $.Deferred()
                         };
 
+                        // When the heartbeat returns a refreshed nonce array, apply it.
+                        $( document ).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
+                                if ( 'undefined' !== typeof data['wp-customize-nonces'] ) {
+                                        api.trigger( 'nonce-refresh', data['wp-customize-nonces'] );
+                                }
+                        } );
+
+                        // Attach our existing nonce to the heartbeat request, so it can be checked for expiration.
+                        $( document ).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
+                                data['wp-customize-nonces'] = api.settings.nonce;
+                                data['isCustomizer']        = true;
+                        } );
+
                         /*
                          * Wrap this.refresh to prevent it from hammering the servers:
                          *

src/wp-includes/class-wp-customize-manager.php

@@ -304 +304 @@
 
                 // Export the settings to JS via the _wpCustomizeSettings variable.
                 add_action( 'customize_controls_print_footer_scripts', array( $this, 'customize_pane_settings' ), 1000 );
+
+                // Refresh the customizer nonces using the hearbeat api.
+                add_filter( 'heartbeat_received', array( $this, 'wp_heartbeat_refresh_customizer_nonces' ), 10,  3 );
+                add_filter( 'heartbeat_settings', array( $this, 'wp_heartbeat_settings_customizer_filter' ) );
+
         }
 
         /**
+         * Filter heartbeat settings for the Customizer.
+         *
+         * @since 4.5.0
+         *
+         * @param array $settings  Current settings to filter.
+         * @return array
+         */
+                public function wp_heartbeat_settings_customizer_filter( $settings ) {
+                        global $pagenow;
+
+                        if ( 'customize.php' !== $pagenow ) {
+                                return $settings;
+                        }
+                        $settings['screenId'] = 'customize';
+
+                        return $settings;
+                }
+
+        /**
+         * Return refreshed customizer nonces when needed.
+         *
+         * @since 4.5.0
+         *
+         * @param array  $response  The Heartbeat response.
+         * @param array  $data      The $_POST data sent.
+         * @param string $screen_id The screen id.
+         * @return array The Heartbeat response.
+         */
+        function wp_heartbeat_refresh_customizer_nonces( $response, $data, $screen_id ) {
+                if ( array_key_exists( 'wp-customize-nonces', $data ) && current_user_can( 'customize' ) ) {
+                        $received = $data['wp-customize-nonces'];
+                        if ( 2 === wp_verify_nonce( $received['save'], 'save-customize_' . $this->get_stylesheet() ) ) {
+                                $response['wp-customize-nonces'] = $this->get_nonces();
+                        }
+                }
+
+                return $response;
+        }
+
+        /**
          * Return true if it's an AJAX request.
          *
          * @since 3.4.0

src/wp-includes/js/heartbeat.js

@@ -367 +367 @@
                                 has_focus: settings.hasFocus
                         };
 
+                        if ( heartbeatData.isCustomizer  ) {
+                                ajaxData.wp_customize = 'on';
+                                delete ajaxData.data.isCustomizer;
+                        }
+
                         settings.connecting = true;
                         settings.xhr = $.ajax({
                                 url: settings.url,