Ticket #40422: 40422.2.diff

src/wp-includes/js/wp-api.js

@@ -758 +758 @@
                                         model.unset( 'slug' );
                                 }
 
-                                if ( ! _.isUndefined( wpApiSettings.nonce ) && ! _.isNull( wpApiSettings.nonce ) ) {
+                                if ( ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
                                         beforeSend = options.beforeSend;
 
                                         // @todo enable option for jsonp endpoints
                                         // options.dataType = 'jsonp';
 
+                                        // Include the nonce with requests.
                                         options.beforeSend = function( xhr ) {
-                                                xhr.setRequestHeader( 'X-WP-Nonce', wpApiSettings.nonce );
+                                                xhr.setRequestHeader( 'X-WP-Nonce', model.nonce() );
 
                                                 if ( beforeSend ) {
                                                         return beforeSend.apply( this, arguments );
                                                 }
                                         };
+
+                                        // Update the nonce when a new nonce is returned with the response.
+                                        options.complete = function( xhr ) {
+                                                var returnedNonce = xhr.getResponseHeader( 'X-WP-Nonce' );
+
+                                                if ( returnedNonce && model.nonce() !== returnedNonce ) {
+                                                        model.endpointModel.set( 'nonce', returnedNonce );
+                                                }
+                                        };
                                 }
 
                                 // Add '?force=true' to use delete method when required.
@@ -1009 +1020 @@
                 defaults: {
                         apiRoot: wpApiSettings.root,
                         versionString: wp.api.versionString,
+                        nonce: null,
                         schema: null,
                         models: {},
                         collections: {}
@@ -1026 +1038 @@
                         model.schemaConstructed = deferred.promise();
 
                         model.schemaModel = new wp.api.models.Schema( null, {
-                                apiRoot: model.get( 'apiRoot' ),
-                                versionString: model.get( 'versionString' )
+                                apiRoot:       model.get( 'apiRoot' ),
+                                versionString: model.get( 'versionString' ),
+                                nonce:         model.get( 'nonce' )
                         } );
 
                         // When the model loads, resolve the promise.
@@ -1194 +1207 @@
                                                         return url;
                                                 },
 
+                                                // Track nonces on the Endpoint 'routeModel'.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
+                                                endpointModel: routeModel,
+
                                                 // Include a reference to the original route object.
                                                 route: modelRoute,
 
@@ -1240 +1260 @@
                                                         return url;
                                                 },
 
+                                                // Track nonces at the Endpoint level.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
+                                                endpointModel: routeModel,
+
                                                 // Include a reference to the original route object.
                                                 route: modelRoute,
 
@@ -1361 +1388 @@
                 var endpoint, attributes = {}, deferred, promise;
 
                 args                     = args || {};
+                attributes.nonce         = args.nonce || wpApiSettings.nonce || '';
                 attributes.apiRoot       = args.apiRoot || wpApiSettings.root || '/wp-json';
                 attributes.versionString = args.versionString || wpApiSettings.versionString || 'wp/v2/';
                 attributes.schema        = args.schema || null;