Ticket #35662: 35662.8.diff

src/wp-includes/rest-api.php

@@ -559 +559 @@
                 return $result;
         }
 
-        global $wp_rest_auth_cookie;
-
+        global $wp_rest_auth_cookie, $wp_rest_server;
         /*
          * Is cookie authentication being used? (If we get an auth
          * error, but we're still logged in, another authentication
@@ -592 +591 @@
                 return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Cookie nonce is invalid' ), array( 'status' => 403 ) );
         }
 
+        // If nonce is verified, always send a refreshed nonce in header.
+        $wp_rest_server->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+
         return true;
 }
 

tests/phpunit/tests/rest-api/rest-server.php

@@ -23 +23 @@
         public function tearDown() {
                 // Remove our temporary spy server
                 $GLOBALS['wp_rest_server'] = null;
+                unset( $_REQUEST['_wpnonce'] );
 
                 parent::tearDown();
         }
@@ -882 +883 @@
         public function filter_wp_rest_server_class() {
                 return 'Spy_REST_Server';
         }
+
+        /**
+         * Refreshed nonce should not be present in header when an invalid nonce is passed for logged in user
+         *
+         * @ticket 35662
+         */
+        function test_rest_send_refreshed_nonce_invalid_nonce() {
+                // Create and set the current user and auth cookie.
+                $this->helper_setup_user_for_rest_send_refreshed_nonce_tests();
+
+                // Mock the nonce.
+                $_REQUEST['_wpnonce'] = 'random invalid nonce';
+
+                $headers = $this->helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests();
+
+                // Run the assertions.
+                $this->assertArrayNotHasKey( 'X-WP-Nonce', $headers );
+        }
+
+        /**
+         * Refreshed nonce should be present in header when a valid nonce is passed for logged in/anonymous user
+         * and not present when nonce is not passed
+         *
+         * @ticket 35662
+         *
+         * @dataProvider data_rest_send_refreshed_nonce
+         *
+         * @param bool $has_logged_in_user Will there be a logged in user for this test.
+         * @param bool $has_nonce          Are we passing the nonce.
+         */
+        function test_rest_send_refreshed_nonce( $has_logged_in_user, $has_nonce ) {
+                if ( true == $has_logged_in_user ) {
+                        // Create and set the current user and auth cookie.
+                        $this->helper_setup_user_for_rest_send_refreshed_nonce_tests();
+                }
+
+                if ( $has_nonce ) {
+                        // Mock the nonce.
+                        $_REQUEST['_wpnonce'] = wp_create_nonce( 'wp_rest' );
+                }
+
+                $headers = $this->helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests();
+
+                // Run the assertions.
+                if ( $has_nonce ) {
+                        $this->assertArrayHasKey( 'X-WP-Nonce', $headers );
+                } else {
+                        $this->assertArrayNotHasKey( 'X-WP-Nonce', $headers );
+                }
+        }
+
+        /**
+         * @return array {
+         *     @type array {
+         *         @type bool $has_logged_in_user Are we registering a user for the test.
+         *         @type bool $has_nonce          Is the nonce passed.
+         *     }
+         * }
+         */
+        function data_rest_send_refreshed_nonce() {
+                return array(
+                        array( true, true ),
+                        array( true, false ),
+                        array( false, true ),
+                        array( false, false ),
+                );
+        }
+
+        /**
+         * Helper to setup a users and auth cookie global for the rest_send_refreshed_nonce related tests.
+         */
+        function helper_setup_user_for_rest_send_refreshed_nonce_tests() {
+                // Create and set the current user.
+                $author = self::factory()->user->create( array( 'role' => 'author' ) );
+                wp_set_current_user( $author );
+
+                // Set rest auth cookie to true for logged in users.
+                global $wp_rest_auth_cookie;
+                $wp_rest_auth_cookie = true;
+        }
+
+        /**
+         * Helper to make the request and get the headers for the rest_send_refreshed_nonce related tests.
+         *
+         * @return array
+         */
+        function helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests() {
+                $request = new WP_REST_Request( 'GET', '/', array() );
+                $result  = $this->server->serve_request( '/' );
+
+                return $this->server->sent_headers;
+        }
 }