Ticket #35617: 35617.0.diff

src/wp-admin/js/customize-controls.js

@@ -3375 +3375 @@
                 api.bind( 'nonce-refresh', function( nonce ) {
                         $.extend( api.settings.nonce, nonce );
                         $.extend( api.previewer.nonce, nonce );
+                        api.previewer.send( 'nonce-refresh', nonce );
                 });
 
                 // Create Settings

src/wp-includes/class-wp-customize-manager.php

@@ -801 +801 @@
          */
         public function customize_preview_settings() {
                 $settings = array(
+                        'theme'    => array(
+                                'stylesheet' => $this->get_stylesheet(),
+                                'active'     => $this->is_theme_active(),
+                        ),
                         'channel' => wp_unslash( $_POST['customize_messenger_channel'] ),
                         'activePanels' => array(),
                         'activeSections' => array(),
@@ -808 +812 @@
                         '_dirty' => array_keys( $this->unsanitized_post_values() ),
                 );
 
-                if ( 2 == $this->nonce_tick ) {
-                        $settings['nonce'] = array(
-                                'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
-                                'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() )
-                        );
-                }
+                $settings['nonce'] = array(
+                        'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
+                        'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() ),
+                );
+
+                /** This filter is documented in wp-includes/class-wp-customize-manager.php */
+                $settings['nonce'] = apply_filters( 'customize_refresh_nonces', $settings['nonce'], $this );
 
                 foreach ( $this->panels as $panel_id => $panel ) {
                         if ( $panel->check_capabilities() ) {
@@ -1703 +1708 @@
                         'documentTitleTmpl' => $this->get_document_title_template(),
                 );
 
+                /** This filter is documented in wp-includes/class-wp-customize-manager.php */
+                $settings['nonce'] = apply_filters( 'customize_refresh_nonces', $settings['nonce'], $this );
+
                 // Prepare Customize Section objects to pass to JavaScript.
                 foreach ( $this->sections() as $id => $section ) {
                         if ( $section->check_capabilities() ) {

src/wp-includes/js/customize-preview.js

@@ -146 +146 @@
                 });
 
                 api.preview.bind( 'active', function() {
-                        if ( api.settings.nonce ) {
-                                api.preview.send( 'nonce', api.settings.nonce );
-                        }
+                        api.preview.send( 'nonce', api.settings.nonce );
 
                         api.preview.send( 'documentTitle', document.title );
                 });
@@ -163 +161 @@
                         } );
                 } );
 
+                api.preview.bind( 'nonce-refresh', function( nonce ) {
+                        $.extend( api.settings.nonce, nonce );
+                } );
+
                 /*
                  * Send a message to the parent customize frame with a list of which
                  * containers and controls are active.