Ticket #37569: 37569.2.diff

src/wp-admin/includes/admin-filters.php

@@ -63 +63 @@
 add_filter( 'heartbeat_received', 'wp_refresh_post_lock',   10,  3 );
 add_filter( 'wp_refresh_nonces', 'wp_refresh_post_nonces', 10,  3 );
 add_filter( 'heartbeat_received', 'heartbeat_autosave',     500, 2 );
+add_filter( 'heartbeat_received', 'rest_refresh_nonce_on_heartbeat', 10,  2 );
 
 add_filter( 'heartbeat_settings', 'wp_heartbeat_set_suspension' );
 

new file src/wp-includes/js/wp-api-nonce.js

@@ +1 @@
+jQuery( function ($) {
+
+        // Send the current core `wp_rest` nonce with each heartbeat.
+        $( document ).on( 'heartbeat-send', function ( e, data ) {
+                data['wp-refresh-rest-nonce'] = wp.api.endpoints.at(0).get( 'nonce' );
+        });
+
+        // If a new nonce is returned with the heartbeat, update the core nonce.
+        $( document ).on( 'heartbeat-tick', function ( e, data ) {
+                if ( 'wp-refresh-rest-nonce' in data ) {
+                        wp.api.endpoints.at(0).set( 'nonce', data['wp-refresh-rest-nonce'] );
+                }
+        });
+});

src/wp-includes/rest-api.php

@@ -746 +746 @@
         return true;
 }
 
+/**
+ * Refresh the REST API nonce on heartbeat requests.
+ *
+ * @since 4.9
+ *
+ * @param array  $response  The Heartbeat response.
+ * @param array  $data      The $_POST data sent.
+ * @return array The Heartbeat response.
+ */
+function rest_refresh_nonce_on_heartbeat( $response, $data ) {
+        if ( array_key_exists( 'wp-refresh-rest-nonce', $data ) ) {
+
+                // Are we in the second tick, meaning the nonce was generated between 12 and 24 hours ago?
+                if ( 2 === wp_verify_nonce( $data['wp-refresh-rest-nonce'] ) ) {
+
+                        // Update nonce.
+                        $response['wp-refresh-rest-nonce'] = wp_create_nonce( 'wp_rest' );
+                }
+        }
+
+        return $response;
+}
+
 /**
  * Collects cookie authentication status.
  *

src/wp-includes/script-loader.php

@@ -505 +505 @@
                 'ariaShow' => esc_attr__( 'Show password' ),
                 'ariaHide' => esc_attr__( 'Hide password' ),
         ) );
+        $scripts->add( 'wp-api-nonce', "/wp-includes/js/wp-api-nonce$suffix.js", array( 'jquery', 'heartbeat' ), false, 1 );
 
         $scripts->add( 'language-chooser', "/wp-admin/js/language-chooser$suffix.js", array( 'jquery' ), false, 1 );
 
@@ -618 +619 @@
         $scripts->add( 'media-audiovideo', "/wp-includes/js/media-audiovideo$suffix.js", array( 'media-editor' ), false, 1 );
         $scripts->add( 'mce-view', "/wp-includes/js/mce-view$suffix.js", array( 'shortcode', 'jquery', 'media-views', 'media-audiovideo' ), false, 1 );
 
-        $scripts->add( 'wp-api', "/wp-includes/js/wp-api$suffix.js", array( 'jquery', 'backbone', 'underscore', 'wp-api-request' ), false, 1 );
+        $scripts->add( 'wp-api', "/wp-includes/js/wp-api$suffix.js", array( 'jquery', 'backbone', 'underscore', 'wp-api-request', 'wp-api-nonce' ), false, 1 );
 
         if ( is_admin() ) {
                 $scripts->add( 'admin-tags', "/wp-admin/js/tags$suffix.js", array( 'jquery', 'wp-ajax-response' ), false, 1 );