Ticket #35617: 35617.1.diff

src/wp-admin/js/customize-controls.js

@@ -3375 +3375 @@
                 api.bind( 'nonce-refresh', function( nonce ) {
                         $.extend( api.settings.nonce, nonce );
                         $.extend( api.previewer.nonce, nonce );
+                        api.previewer.send( 'nonce-refresh', nonce );
                 });
 
                 // Create Settings

src/wp-includes/class-wp-customize-manager.php

@@ -801 +801 @@
          */
         public function customize_preview_settings() {
                 $settings = array(
+                        'theme'    => array(
+                                'stylesheet' => $this->get_stylesheet(),
+                                'active'     => $this->is_theme_active(),
+                        ),
                         'channel' => wp_unslash( $_POST['customize_messenger_channel'] ),
                         'activePanels' => array(),
                         'activeSections' => array(),
@@ -808 +812 @@
                         '_dirty' => array_keys( $this->unsanitized_post_values() ),
                 );
 
-                if ( 2 == $this->nonce_tick ) {
-                        $settings['nonce'] = array(
-                                'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
-                                'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() )
-                        );
-                }
+                $settings['nonce'] = array(
+                        'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
+                        'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() ),
+                );
+
+                /** This filter is documented in wp-includes/class-wp-customize-manager.php */
+                $settings['nonce'] = apply_filters( 'customize_refresh_nonces', $settings['nonce'], $this );
 
                 foreach ( $this->panels as $panel_id => $panel ) {
                         if ( $panel->check_capabilities() ) {
@@ -1703 +1708 @@
                         'documentTitleTmpl' => $this->get_document_title_template(),
                 );
 
+                /** This filter is documented in wp-includes/class-wp-customize-manager.php */
+                $settings['nonce'] = apply_filters( 'customize_refresh_nonces', $settings['nonce'], $this );
+
                 // Prepare Customize Section objects to pass to JavaScript.
                 foreach ( $this->sections() as $id => $section ) {
                         if ( $section->check_capabilities() ) {

src/wp-includes/class-wp-customize-nav-menus.php

@@ -940 +940 @@
                         'renderNonceValue'      => wp_create_nonce( self::RENDER_AJAX_ACTION ),
                         'renderNoncePostKey'    => self::RENDER_NONCE_POST_KEY,
                         'requestUri'            => empty( $_SERVER['REQUEST_URI'] ) ? home_url( '/' ) : esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ),
-                        'theme'                 => array(
-                                'stylesheet' => $this->manager->get_stylesheet(),
-                                'active'     => $this->manager->is_theme_active(),
-                        ),
-                        'previewCustomizeNonce' => wp_create_nonce( 'preview-customize_' . $this->manager->get_stylesheet() ),
                         'navMenuInstanceArgs'   => $this->preview_nav_menu_instance_args,
                         'l10n'                  => array(
                                 'editNavMenuItemTooltip' => __( 'Shift-click to edit this menu item.' ),

src/wp-includes/js/customize-preview-nav-menus.js

@@ -13 +13 @@
                         renderQueryVar: null,
                         renderNonceValue: null,
                         renderNoncePostKey: null,
-                        previewCustomizeNonce: null,
                         requestUri: '/',
-                        theme: {
-                                active: false,
-                                stylesheet: ''
-                        },
                         navMenuInstanceArgs: {},
                         l10n: {}
                 };
@@ -200 +195 @@
                         menuId = parseInt( menuId, 10 );
 
                         data = {
-                                nonce: settings.previewCustomizeNonce, // for Customize Preview
+                                nonce: wp.customize.settings.nonce.preview,
                                 wp_customize: 'on'
                         };
-                        if ( ! settings.theme.active ) {
-                                data.theme = settings.theme.stylesheet;
+                        if ( ! wp.customize.settings.theme.active ) {
+                                data.theme = wp.customize.settings.theme.stylesheet;
                         }
                         data[ settings.renderQueryVar ] = '1';
 

src/wp-includes/js/customize-preview.js

@@ -146 +146 @@
                 });
 
                 api.preview.bind( 'active', function() {
-                        if ( api.settings.nonce ) {
-                                api.preview.send( 'nonce', api.settings.nonce );
-                        }
+                        api.preview.send( 'nonce', api.settings.nonce );
 
                         api.preview.send( 'documentTitle', document.title );
                 });
@@ -163 +161 @@
                         } );
                 } );
 
+                api.preview.bind( 'nonce-refresh', function( nonce ) {
+                        $.extend( api.settings.nonce, nonce );
+                } );
+
                 /*
                  * Send a message to the parent customize frame with a list of which
                  * containers and controls are active.