Ticket #37569: 37569.4.diff

src/wp-includes/js/wp-api.js

@@ -816 +816 @@
                         // Initialize the model.
                         initialize: function() {
 
+                                // Limit recursion in sync.
+                                this.maxRecursion = 1;
+
                                 /**
                                 * Types that don't support trashing require passing ?force=true to delete.
                                 *
@@ -864 +867 @@
                                         };
 
                                         // Update the nonce when a new nonce is returned with the response.
-                                        options.complete = function( xhr ) {
+                                        options.complete = _.bind( function( xhr ) {
                                                 var returnedNonce = xhr.getResponseHeader( 'X-WP-Nonce' );
 
                                                 if ( returnedNonce && _.isFunction( model.nonce ) && model.nonce() !== returnedNonce ) {
                                                         model.endpointModel.set( 'nonce', returnedNonce );
+                                                        if ( 'rest_cookie_invalid_nonce' === xhr.responseJSON.code && this.maxRecursion-- > 0 ) {
+                                                                this.sync(  method, model, options );
+                                                        } else {
+                                                                this.maxRecursion = 1;
+                                                        }
                                                 }
-                                        };
+                                        }, this );
+
+
                                 }
 
                                 // Add '?force=true' to use delete method when required.

src/wp-includes/rest-api.php

@@ -780 +780 @@
         // Check the nonce.
         $result = wp_verify_nonce( $nonce, 'wp_rest' );
 
+        if ( is_user_logged_in() ) {
+
+                // Send a refreshed nonce in header.
+                rest_get_server()->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+        }
+
         if ( ! $result ) {
                 return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Cookie nonce is invalid' ), array( 'status' => 403 ) );
         }
 
-        // Send a refreshed nonce in header.
-        rest_get_server()->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
 
         return true;
 }