Ticket #31897: 31897.diff

src/wp-admin/customize.php

@@ -55 +55 @@
 wp_enqueue_script( 'customize-controls' );
 wp_enqueue_style( 'customize-controls' );
 
+// Setup heartbeat to keep nonces up to date.
+wp_enqueue_script( 'heartbeat' );
+
 /**
  * Enqueue Customizer control scripts.
  *

src/wp-admin/includes/admin-filters.php

@@ -80 +80 @@
 // Theme hooks.
 add_action( 'customize_controls_print_footer_scripts', 'customize_themes_print_templates' );
 
+// Customizer hooks: refresh the customizer nonces using the hearbeat api.
+add_filter( 'heartbeat_received', 'wp_refresh_customizer_nonces', 10,  3 );
+
+
 // Theme Install hooks.
 // add_action('install_themes_dashboard', 'install_themes_dashboard');
 // add_action('install_themes_upload', 'install_themes_upload', 10, 0);

src/wp-admin/includes/ajax-actions.php

@@ -2707 +2707 @@
                         wp_send_json( $response );
                 }
         }
-
         if ( ! empty( $data ) ) {
                 /**
                  * Filter the Heartbeat response received.

src/wp-admin/includes/misc.php

@@ -843 +843 @@
         return $response;
 }
 
+        /**
+         * Return refreshed customizer nonces when needed.
+         *
+         * @since 4.5.0
+         */
+function wp_refresh_customizer_nonces( $response, $data, $screen_id ) {
+
+        if ( array_key_exists( 'wp-refresh-customizer-nonce', $data ) ) {
+
+                // Bootstrap the customizer.
+                require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+                $GLOBALS['wp_customize'] = new WP_Customize_Manager();
+                $wp_customize            = $GLOBALS['wp_customize'];
+
+                $received = $data['wp-refresh-customizer-nonce'];
+
+                if ( 2 === wp_verify_nonce( $received['save'], 'save-customize_' . $wp_customize->get_stylesheet() ) ) {
+                        $response['wp-refresh-customizer-nonce'] = $wp_customize->get_nonces();
+                }
+        }
+
+        return $response;
+}
+
 /**
  * Disable suspension of Heartbeat on the Add/Edit Post screens.
  *

src/wp-admin/js/customize-controls.js

@@ -2946 +2946 @@
                                 active: $.Deferred()
                         };
 
+                        // When the heartbeat returns a refreshed nonce array, apply it.
+                        $( document ).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
+                                if ( 'undefined' !== typeof data['wp-refresh-customizer-nonce'] ) {
+                                        api.trigger( 'nonce-refresh', data['wp-refresh-customizer-nonce'] );
+                                }
+                        } );
+
+                        // Attach our existing nonce to the heartbeat request, so it can be checked for expiration.
+                        $( document ).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
+                                data['wp-refresh-customizer-nonce'] = api.settings.nonce;
+                        } );
+
                         /*
                          * Wrap this.refresh to prevent it from hammering the servers:
                          *