Ticket #43265: 43265.patch

src/wp-includes/js/wp-api.js

@@ -993 +993 @@
                                 options    = options || {};
                                 beforeSend = options.beforeSend;
 
-                                // If we have a localized nonce, pass that along with each sync.
-                                if ( 'undefined' !== typeof wpApiSettings.nonce ) {
+                                if ( _.isFunction( model.nonce ) && ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
                                         options.beforeSend = function( xhr ) {
-                                                xhr.setRequestHeader( 'X-WP-Nonce', wpApiSettings.nonce );
+                                                xhr.setRequestHeader( 'X-WP-Nonce', model.nonce() );
 
                                                 if ( beforeSend ) {
                                                         return beforeSend.apply( self, arguments );
@@ -1405 +1404 @@
                                                         return new loadingObjects.models[ modelClassName ]( attrs, options );
                                                 },
 
+                                                // Track nonces at the Endpoint level.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
                                                 // Include a reference to the original class name.
                                                 name: collectionClassName,
 
@@ -1432 +1436 @@
                                                         return new loadingObjects.models[ modelClassName ]( attrs, options );
                                                 },
 
+                                                // Track nonces at the Endpoint level.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
                                                 // Include a reference to the original class name.
                                                 name: collectionClassName,