Ticket #48076: nonce-1.diff

src/wp-admin/admin-ajax.php

@@ -53 +53 @@
         'autocomplete-user',
         'dashboard-widgets',
         'logged-in',
+        'rest-nonce',
 );
 
 $core_actions_post = array(

src/wp-admin/includes/ajax-actions.php

@@ -5268 +5268 @@
 
         wp_send_json_success( $all_sizes );
 }
+
+/**
+ * Ajax handler to renew the REST API nonce.
+ *
+ * @since 5.3.0
+ */
+function wp_ajax_rest_nonce() {
+        exit( wp_create_nonce( 'wp_rest' ) );
+}

src/wp-includes/script-loader.php

@@ -651 +651 @@
         }
         $scripts->add_inline_script(
                 'wp-api-fetch',
-                sprintf(
-                        implode(
-                                "\n",
-                                array(
-                                        '( function() {',
-                                        '       var nonceMiddleware = wp.apiFetch.createNonceMiddleware( "%s" );',
-                                        '       wp.apiFetch.use( nonceMiddleware );',
-                                        '       wp.hooks.addAction(',
-                                        '               "heartbeat.tick",',
-                                        '               "core/api-fetch/create-nonce-middleware",',
-                                        '               function( response ) {',
-                                        '                       if ( response[ "rest_nonce" ] ) {',
-                                        '                               nonceMiddleware.nonce = response[ "rest_nonce" ];',
-                                        '                       }',
-                                        '               }',
-                                        '       );',
-                                        '} )();',
-                                )
+                join( array(
+                        sprintf(
+                                'wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware( "%s" );',
+                                ( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce( 'wp_rest' )
                         ),
-                        ( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce( 'wp_rest' )
-                ),
+                        'wp.apiFetch.use( wp.apiFetch.nonceMiddleware );',
+                        sprintf(
+                                'wp.apiFetch.nonceEndpoint = "%s";',
+                                admin_url( 'admin-ajax.php?action=rest-nonce' )
+                        ),
+                ), "\n" ),
                 'after'
         );
         $scripts->add_inline_script(