Ticket #45113: 45113.heartbeatnonce.2.diff

wp-admin/includes/admin-filters.php

@@ -56 +56 @@
 }
 
 add_action( 'admin_print_scripts-post.php',     'wp_page_reload_on_back_button_js' );
 add_action( 'admin_print_scripts-post-new.php', 'wp_page_reload_on_back_button_js' );
 
 add_action( 'update_option_home',          'update_home_siteurl', 10, 2 );
 add_action( 'update_option_siteurl',       'update_home_siteurl', 10, 2 );
 add_action( 'update_option_page_on_front', 'update_home_siteurl', 10, 2 );
 add_action( 'update_option_admin_email',   'wp_site_admin_email_change_notification', 10, 3 );
 
 add_action( 'add_option_new_admin_email',    'update_option_new_admin_email', 10, 2 );
 add_action( 'update_option_new_admin_email', 'update_option_new_admin_email', 10, 2 );
 
 add_filter( 'heartbeat_received', 'wp_check_locked_posts',  10,  3 );
 add_filter( 'heartbeat_received', 'wp_refresh_post_lock',   10,  3 );
-add_filter( 'wp_refresh_nonces', 'wp_refresh_post_nonces', 10,  3 );
 add_filter( 'heartbeat_received', 'heartbeat_autosave',     500, 2 );
 
+add_filter( 'wp_refresh_nonces', 'wp_refresh_post_nonces', 10, 3 );
+add_filter( 'wp_refresh_nonces', 'wp_refresh_heartbeat_nonces' );
+
 add_filter( 'heartbeat_settings', 'wp_heartbeat_set_suspension' );
 
 // Nav Menu hooks.
 add_action( 'admin_head-nav-menus.php', '_wp_delete_orphaned_draft_menu_items' );
 
 // Plugin hooks.
 add_filter( 'whitelist_options', 'option_update_filter' );
 
 // Plugin Install hooks.
 add_action( 'install_plugins_featured',               'install_dashboard' );
 add_action( 'install_plugins_upload',                 'install_plugins_upload' );
 add_action( 'install_plugins_search',                 'display_plugins_table' );
 add_action( 'install_plugins_popular',                'display_plugins_table' );
 add_action( 'install_plugins_recommended',            'display_plugins_table' );
 add_action( 'install_plugins_new',                    'display_plugins_table' );

wp-admin/includes/misc.php

@@ -1008 +1008 @@
                         return $response;
                 }
 
                 if ( ! current_user_can( 'edit_post', $post_id ) ) {
                         return $response;
                 }
 
                 $response['wp-refresh-post-nonces'] = array(
                         'replace' => array(
                                 'getpermalinknonce' => wp_create_nonce('getpermalink'),
                                 'samplepermalinknonce' => wp_create_nonce('samplepermalink'),
                                 'closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
                                 '_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
                                 '_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
                         ),
-                        'heartbeatNonce' => wp_create_nonce( 'heartbeat-nonce' ),
                 );
         }
 
         return $response;
 }
 
 /**
+ * Add the latest Heartbeat and REST-API nonce to the Heartbeat response.
+ *
+ * @since 5.0.0
+ *
+ * @param array  $response  The Heartbeat response.
+ * @return array The Heartbeat response.
+ */
+function wp_refresh_heartbeat_nonces( $response ) {
+        // Refresh the Rest API nonce.
+        $response['rest_nonce'] = wp_create_nonce( 'wp_rest' );
+        // TEMPORARY: Compat with api-fetch library
+        $response['rest-nonce'] = $response['rest_nonce'];
+
+        // Refresh the Heartbeat nonce.
+        $response['heartbeat_nonce'] = wp_create_nonce( 'heartbeat-nonce' );
+        return $response;
+}
+
+/**
  * Disable suspension of Heartbeat on the Add/Edit Post screens.
  *
  * @since 3.8.0
  *
  * @global string $pagenow
  *
  * @param array $settings An array of Heartbeat settings.
  * @return array Filtered Heartbeat settings.
  */
 function wp_heartbeat_set_suspension( $settings ) {
         global $pagenow;
 
         if ( 'post.php' === $pagenow || 'post-new.php' === $pagenow ) {
                 $settings['suspension'] = 'disable';
         }

wp-includes/js/heartbeat.js

@@ -300 +300 @@
                                         case 'parsererror':
                                         case 'empty':
                                         case 'unknown':
                                                 settings.errorcount++;
 
                                                 if ( settings.errorcount > 2 && settings.hasConnected ) {
                                                         trigger = true;
                                                 }
 
                                                 break;
                                 }
 
                                 if ( trigger && ! hasConnectionError() ) {
                                         settings.connectionError = true;
                                         $document.trigger( 'heartbeat-connection-lost', [error, status] );
+                                        wp.hooks.doAction( 'heartbeat.connection-lost', error, status );
                                 }
                         }
                 }
 
                 /**
                  * Clear the error state and fire an event
                  *
                  * @access private
                  *
                  * @return void
                  */
                 function clearErrorState() {
                         // Has connected successfully
                         settings.hasConnected = true;
 
                         if ( hasConnectionError() ) {
                                 settings.errorcount = 0;
                                 settings.connectionError = false;
                                 $document.trigger( 'heartbeat-connection-restored' );
+                                wp.hooks.doAction( 'heartbeat.connection-restored' );
                         }
                 }
 
                 /**
                  * Gather the data and connect to the server
                  *
                  * @access private
                  *
                  * @return void
                  */
                 function connect() {
                         var ajaxData, heartbeatData;
 
                         // If the connection to the server is slower than the interval,
                         // heartbeat connects as soon as the previous connection's response is received.
                         if ( settings.connecting || settings.suspend ) {
                                 return;
                         }
 
                         settings.lastTick = time();
 
                         heartbeatData = $.extend( {}, settings.queue );
                         // Clear the data queue, anything added after this point will be send on the next tick
                         settings.queue = {};
 
                         $document.trigger( 'heartbeat-send', [ heartbeatData ] );
+                        wp.hooks.doAction( 'heartbeat.send', heartbeatData );
 
                         ajaxData = {
                                 data: heartbeatData,
                                 interval: settings.tempInterval ? settings.tempInterval / 1000 : settings.mainInterval / 1000,
                                 _nonce: typeof window.heartbeatSettings === 'object' ? window.heartbeatSettings.nonce : '',
                                 action: 'heartbeat',
                                 screen_id: settings.screenId,
                                 has_focus: settings.hasFocus
                         };
 
                         if ( 'customize' === settings.screenId  ) {
                                 ajaxData.wp_customize = 'on';
                         }
 
                         settings.connecting = true;
@@ -381 +384 @@
                         }).always( function() {
                                 settings.connecting = false;
                                 scheduleNextTick();
                         }).done( function( response, textStatus, jqXHR ) {
                                 var newInterval;
 
                                 if ( ! response ) {
                                         setErrorState( 'empty' );
                                         return;
                                 }
 
                                 clearErrorState();
 
                                 if ( response.nonces_expired ) {
                                         $document.trigger( 'heartbeat-nonces-expired' );
+                                        wp.hooks.doAction( 'heartbeat.nonces-expired' );
                                 }
 
                                 // Change the interval from PHP
                                 if ( response.heartbeat_interval ) {
                                         newInterval = response.heartbeat_interval;
                                         delete response.heartbeat_interval;
                                 }
 
+                                // Update the heartbeat nonce if set.
+                                if ( response.heartbeat_nonce && typeof window.heartbeatSettings === 'object' ) {
+                                        window.heartbeatSettings.nonce = response.heartbeat_nonce;
+                                        delete response.heartbeat_nonce;
+                                }
+
+                                // Update the Rest API nonce if set and wp-api loaded.
+                                if ( response.rest_nonce && typeof window.wpApiSettings === 'object' ) {
+                                        window.wpApiSettings.nonce = response.rest_nonce;
+                                        // This nonce is required for api-fetch through heartbeat.tick.
+                                        // delete response.rest_nonce;
+                                }
+
                                 $document.trigger( 'heartbeat-tick', [response, textStatus, jqXHR] );
+                                wp.hooks.doAction( 'heartbeat.tick', response, textStatus, jqXHR );
 
                                 // Do this last, can trigger the next XHR if connection time > 5 sec. and newInterval == 'fast'
                                 if ( newInterval ) {
                                         interval( newInterval );
                                 }
                         }).fail( function( jqXHR, textStatus, error ) {
                                 setErrorState( textStatus || 'unknown', jqXHR.status );
                                 $document.trigger( 'heartbeat-error', [jqXHR, textStatus, error] );
+                                wp.hooks.doAction( 'heartbeat.error', jqXHR, textStatus, error );
                         });
                 }
 
                 /**
                  * Schedule the next connection
                  *
                  * Fires immediately if the connection time is longer than the interval.
                  *
                  * @access private
                  *
                  * @return void
                  */
                 function scheduleNextTick() {
                         var delta = time() - settings.lastTick,
                                 interval = settings.mainInterval;

wp-includes/script-loader.php

@@ -857 +857 @@
         $scripts->add( 'wp-api-request', "/wp-includes/js/api-request$suffix.js", array( 'jquery' ), false, 1 );
         // `wpApiSettings` is also used by `wp-api`, which depends on this script.
         did_action( 'init' ) && $scripts->localize( 'wp-api-request', 'wpApiSettings', array(
                 'root'          => esc_url_raw( get_rest_url() ),
                 'nonce'         => ( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce( 'wp_rest' ),
                 'versionString' => 'wp/v2/',
         ) );
 
         $scripts->add( 'wp-pointer', "/wp-includes/js/wp-pointer$suffix.js", array( 'jquery-ui-widget', 'jquery-ui-position' ), '20111129a', 1 );
         did_action( 'init' ) && $scripts->localize( 'wp-pointer', 'wpPointerL10n', array(
                 'dismiss' => __('Dismiss'),
         ) );
 
         $scripts->add( 'autosave', "/wp-includes/js/autosave$suffix.js", array('heartbeat'), false, 1 );
 
-        $scripts->add( 'heartbeat', "/wp-includes/js/heartbeat$suffix.js", array('jquery'), false, 1 );
+        $scripts->add( 'heartbeat', "/wp-includes/js/heartbeat$suffix.js", array( 'jquery', 'wp-hooks' ), false, 1 );
         did_action( 'init' ) && $scripts->localize( 'heartbeat', 'heartbeatSettings',
                 /**
                  * Filters the Heartbeat settings.
                  *
                  * @since 3.6.0
                  *
                  * @param array $settings Heartbeat settings array.
                  */
                 apply_filters( 'heartbeat_settings', array() )
         );
 
         $scripts->add( 'wp-auth-check', "/wp-includes/js/wp-auth-check$suffix.js", array('heartbeat'), false, 1 );
         did_action( 'init' ) && $scripts->localize( 'wp-auth-check', 'authcheckL10n', array(
                 'beforeunload' => __('Your session has expired. You can log in again from this page or go to the login page.'),