Ticket #38573: 38573.wip.diff

src/wp-admin/js/customize-controls.js

@@ -5095 +5095 @@
                         api.control.add( id, control );
                 });
 
+                // @todo Pass allowed arrays?
+                $.ajaxPrefilter( api.utils.prefilterAjaxPreviewingRequests );
+
                 // Focus the autofocused element
                 _.each( [ 'panel', 'section', 'control' ], function( type ) {
                         var id = api.settings.autofocus[ type ];

src/wp-includes/js/customize-base.js

@@ -844 +844 @@
                 return queryParams;
         };
 
+        /**
+         * Should the supplied URL be previewable.
+         *
+         * @since 4.7.0
+         * @access public
+         *
+         * @param {string|HTMLAnchorElement|HTMLAreaElement} url URL.
+         * @param {string} element.search Query string.
+         * @param {string} element.pathname Path.
+         * @param {string} element.host Host.
+         * @param {object} [options]
+         * @param {object} [options.allowAdminAjax=false] Allow admin-ajax.php requests.
+         * @param {object} [options.allowedUrls] Allowed URLs. Defaults to wp.customize.settings.url.allowed.
+         * @returns {boolean} Is appropriate for changeset link.
+         */
+        api.utils.isUrlPreviewable = function isUrlPreviewable( url, options ) {
+                var matchesAllowedUrl, parsedAllowedUrl, args, element;
+
+                if ( _.isString( url ) ) {
+                        element = document.createElement( 'a' );
+                        element.href = url;
+                } else {
+                        element = url;
+                }
+
+                args = _.extend( {}, { allowAdminAjax: false }, options || {} );
+
+                if ( 'javascript:' === element.protocol ) { // jshint ignore:line
+                        return true;
+                }
+
+                // Only web URLs can be previewed.
+                if ( 'https:' !== element.protocol && 'http:' !== element.protocol ) {
+                        return false;
+                }
+
+                parsedAllowedUrl = document.createElement( 'a' );
+                matchesAllowedUrl = ! _.isUndefined( _.find( args.allowedUrls || api.settings.url.allowed, function( allowedUrl ) {
+                        parsedAllowedUrl.href = allowedUrl;
+                        return parsedAllowedUrl.protocol === element.protocol && parsedAllowedUrl.host === element.host && 0 === element.pathname.indexOf( parsedAllowedUrl.pathname.replace( /\/$/, '' ) );
+                } ) );
+                if ( ! matchesAllowedUrl ) {
+                        return false;
+                }
+
+                // Skip wp login and signup pages.
+                if ( /\/wp-(login|signup)\.php$/.test( element.pathname ) ) {
+                        return false;
+                }
+
+                // Allow links to admin ajax as faux frontend URLs.
+                if ( /\/wp-admin\/admin-ajax\.php$/.test( element.pathname ) ) {
+                        return args.allowAdminAjax;
+                }
+
+                // Disallow links to admin, includes, and content.
+                if ( /\/wp-(admin|includes|content)(\/|$)/.test( element.pathname ) ) {
+                        return false;
+                }
+
+                return true;
+        };
+
+        api.utils.addAjaxRequestPrefilter = function() {
+                // @todo allowed URLs.
+                // @todo allow Admin ajax, true on frontend but false in admin.
+                // @todo This depends on having instantiated settings anyway so really the
+        };
+
+        /**
+         * Rewrite Ajax requests to inject customizer state.
+         *
+         * @since 4.7.0
+         * @access protected
+         *
+         * @param {object} options Options.
+         * @param {string} options.type Type.
+         * @param {string} options.url URL.
+         * @param {object} originalOptions Original options.
+         * @param {XMLHttpRequest} xhr XHR.
+         * @returns {void}
+         */
+        api.utils.prefilterAjaxPreviewingRequests = function prefilterAjaxPreviewingRequests( options, originalOptions, xhr ) {
+                var urlParser, queryParams, requestMethod, dirtyValues = {};
+                urlParser = document.createElement( 'a' );
+                urlParser.href = options.url;
+
+                // Abort if the request is not for this site.
+                if ( ! api.utils.isUrlPreviewable( urlParser, { allowAdminAjax: _.isUndefined( window.pagenow ), allowedUrls: api.settings.url.allowed } ) ) {
+                        return;
+                }
+
+                queryParams = api.utils.parseQueryString( urlParser.search.substring( 1 ) );
+
+                // Abort if if changeset UUID is already present.
+                if ( queryParams.customize_changeset_uuid ) {
+                        return;
+                }
+
+                if ( _.isFunction( api.dirtyValues ) ) {
+                        dirtyValues = api.dirtyValues( { unsaved: true } );
+                } else if ( api.extended( api.Values ) ) {
+                        api.each( function( setting ) {
+                                if ( setting._dirty ) {
+                                        dirtyValues[ setting.id ] = setting.get();
+                                }
+                        } );
+                }
+
+                if ( ! _.isEmpty( dirtyValues ) ) {
+                        requestMethod = options.type.toUpperCase();
+
+                        // Override underlying request method to ensure unsaved changes to changeset can be included (force Backbone.emulateHTTP).
+                        if ( 'POST' !== requestMethod ) {
+                                xhr.setRequestHeader( 'X-HTTP-Method-Override', requestMethod );
+                                queryParams._method = requestMethod;
+                                options.type = 'POST';
+                        }
+
+                        // Amend the post data with the customized values.
+                        if ( options.data ) {
+                                options.data += '&';
+                        } else {
+                                options.data = '';
+                        }
+                        options.data += $.param( {
+                                customized: JSON.stringify( dirtyValues )
+                        } );
+                }
+
+                // Include customized state query params in URL.
+                queryParams.customize_changeset_uuid = api.settings.changeset.uuid;
+                if ( ! api.settings.theme.active ) {
+                        queryParams.customize_theme = api.settings.theme.stylesheet;
+                }
+                urlParser.search = $.param( queryParams );
+                options.url = urlParser.href;
+        };
+
         // Expose the API publicly on window.wp.customize
         exports.customize = api;
 })( wp, jQuery );

src/wp-includes/js/customize-preview.js

@@ -152 +152 @@
                         }
 
                         // If the link is not previewable, prevent the browser from navigating to it.
-                        if ( ! api.isLinkPreviewable( link[0] ) ) {
+                        if ( ! api.utils.isUrlPreviewable( link[0], { allowedUrls: api.settings.url.allowed } ) ) {
                                 wp.a11y.speak( api.settings.l10n.linkUnpreviewable );
                                 event.preventDefault();
                                 return;
@@ -193 +193 @@
                         urlParser.href = form.prop( 'action' );
 
                         // If the link is not previewable, prevent the browser from navigating to it.
-                        if ( 'GET' !== form.prop( 'method' ).toUpperCase() || ! api.isLinkPreviewable( urlParser ) ) {
+                        if ( 'GET' !== form.prop( 'method' ).toUpperCase() || ! api.utils.isUrlPreviewable( urlParser, { allowedUrls: api.settings.url.allowed } ) ) {
                                 wp.a11y.speak( api.settings.l10n.formUnpreviewable );
                                 event.preventDefault();
                                 return;
@@ -268 +268 @@
         };
 
         /**
-         * Should the supplied link is previewable.
-         *
-         * @since 4.7.0
-         * @access public
-         *
-         * @param {HTMLAnchorElement|HTMLAreaElement} element Link element.
-         * @param {string} element.search Query string.
-         * @param {string} element.pathname Path.
-         * @param {string} element.host Host.
-         * @param {object} [options]
-         * @param {object} [options.allowAdminAjax=false] Allow admin-ajax.php requests.
-         * @returns {boolean} Is appropriate for changeset link.
-         */
-        api.isLinkPreviewable = function isLinkPreviewable( element, options ) {
-                var matchesAllowedUrl, parsedAllowedUrl, args;
-
-                args = _.extend( {}, { allowAdminAjax: false }, options || {} );
-
-                if ( 'javascript:' === element.protocol ) { // jshint ignore:line
-                        return true;
-                }
-
-                // Only web URLs can be previewed.
-                if ( 'https:' !== element.protocol && 'http:' !== element.protocol ) {
-                        return false;
-                }
-
-                parsedAllowedUrl = document.createElement( 'a' );
-                matchesAllowedUrl = ! _.isUndefined( _.find( api.settings.url.allowed, function( allowedUrl ) {
-                        parsedAllowedUrl.href = allowedUrl;
-                        return parsedAllowedUrl.protocol === element.protocol && parsedAllowedUrl.host === element.host && 0 === element.pathname.indexOf( parsedAllowedUrl.pathname.replace( /\/$/, '' ) );
-                } ) );
-                if ( ! matchesAllowedUrl ) {
-                        return false;
-                }
-
-                // Skip wp login and signup pages.
-                if ( /\/wp-(login|signup)\.php$/.test( element.pathname ) ) {
-                        return false;
-                }
-
-                // Allow links to admin ajax as faux frontend URLs.
-                if ( /\/wp-admin\/admin-ajax\.php$/.test( element.pathname ) ) {
-                        return args.allowAdminAjax;
-                }
-
-                // Disallow links to admin, includes, and content.
-                if ( /\/wp-(admin|includes|content)(\/|$)/.test( element.pathname ) ) {
-                        return false;
-                }
-
-                return true;
-        };
-
-        /**
          * Inject the customize_changeset_uuid query param into links on the frontend.
          *
          * @since 4.7.0
@@ -352 +297 @@
                         element.protocol = 'https:';
                 }
 
-                if ( ! api.isLinkPreviewable( element ) ) {
+                if ( ! api.utils.isUrlPreviewable( element, { allowedUrls: api.settings.url.allowed } ) ) {
                         $( element ).addClass( 'customize-unpreviewable' );
                         return;
                 }
@@ -375 +320 @@
         };
 
         /**
-         * Inject the changeset UUID into Ajax requests.
-         *
-         * @since 4.7.0
-         * @access protected
-         *
-         * @return {void}
-         */
-        api.addRequestPreviewing = function addRequestPreviewing() {
-
-                /**
-                 * Rewrite Ajax requests to inject customizer state.
-                 *
-                 * @param {object} options Options.
-                 * @param {string} options.type Type.
-                 * @param {string} options.url URL.
-                 * @param {object} originalOptions Original options.
-                 * @param {XMLHttpRequest} xhr XHR.
-                 * @returns {void}
-                 */
-                var prefilterAjax = function( options, originalOptions, xhr ) {
-                        var urlParser, queryParams, requestMethod, dirtyValues = {};
-                        urlParser = document.createElement( 'a' );
-                        urlParser.href = options.url;
-
-                        // Abort if the request is not for this site.
-                        if ( ! api.isLinkPreviewable( urlParser, { allowAdminAjax: true } ) ) {
-                                return;
-                        }
-                        queryParams = api.utils.parseQueryString( urlParser.search.substring( 1 ) );
-
-                        // Note that _dirty flag will be cleared with changeset updates.
-                        api.each( function( setting ) {
-                                if ( setting._dirty ) {
-                                        dirtyValues[ setting.id ] = setting.get();
-                                }
-                        } );
-
-                        if ( ! _.isEmpty( dirtyValues ) ) {
-                                requestMethod = options.type.toUpperCase();
-
-                                // Override underlying request method to ensure unsaved changes to changeset can be included (force Backbone.emulateHTTP).
-                                if ( 'POST' !== requestMethod ) {
-                                        xhr.setRequestHeader( 'X-HTTP-Method-Override', requestMethod );
-                                        queryParams._method = requestMethod;
-                                        options.type = 'POST';
-                                }
-
-                                // Amend the post data with the customized values.
-                                if ( options.data ) {
-                                        options.data += '&';
-                                } else {
-                                        options.data = '';
-                                }
-                                options.data += $.param( {
-                                        customized: JSON.stringify( dirtyValues )
-                                } );
-                        }
-
-                        // Include customized state query params in URL.
-                        queryParams.customize_changeset_uuid = api.settings.changeset.uuid;
-                        if ( ! api.settings.theme.active ) {
-                                queryParams.customize_theme = api.settings.theme.stylesheet;
-                        }
-                        urlParser.search = $.param( queryParams );
-                        options.url = urlParser.href;
-                };
-
-                $.ajaxPrefilter( prefilterAjax );
-        };
-
-        /**
          * Inject changeset UUID into forms, allowing preview to persist through submissions.
          *
          * @since 4.7.0
@@ -501 +375 @@
                         form.action = urlParser.href;
                 }
 
-                if ( 'GET' !== form.method.toUpperCase() || ! api.isLinkPreviewable( urlParser ) ) {
+                if ( 'GET' !== form.method.toUpperCase() || ! api.utils.isUrlPreviewable( urlParser, { allowedUrls: api.settings.url.allowed } ) ) {
                         $( form ).addClass( 'customize-unpreviewable' );
                         return;
                 }
@@ -608 +482 @@
                 });
 
                 api.addLinkPreviewing();
-                api.addRequestPreviewing();
+                $.ajaxPrefilter( api.utils.prefilterAjaxPreviewingRequests );
                 api.addFormPreviewing();
 
                 /**