Ticket #50781: 50781.2.diff

src/wp-includes/class-wp-customize-manager.php

@@ -493 +493 @@
                 return '_default_wp_die_handler';
         }
 
+        /**
+         * Redirects to 404 when changeset UUID does not exists for unauthenticated users.
+         *
+         * @since 5.6.0
+         *
+         * @param bool     $bypass Pass-through of the pre_handle_404 filter value.
+         * @param WP_Query $query  The WP_Query object.
+         * @return bool Bypass value.
+         */
+        public function customize_changeset_preview_redirect( $bypass, $query ) {
+                $query->set_404();
+                status_header( 404 );
+                return $bypass;
+        }
+
         /**
          * Start preview and customize theme.
          *
          * Check if customize query variable exist. Init filters to filter the current theme.
          *
          * @since 3.4.0
+         * @since 5.6.0 Redirects to 404 when changeset UUID does not exists for unauthenticated users.
          *
          * @global string $pagenow
          */
@@ -548 +564 @@
                  * then send unauthenticated code to prompt re-auth.
                  */
                 if ( ! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) {
-                        $this->wp_die( $this->messenger_channel ? 0 : -1, __( 'Non-existent changeset UUID.' ) );
+                        // As this is a preview page sending noindex in headers.
+                        if ( ! headers_sent() ) {
+                                nocache_headers();
+                                header( 'X-Robots: noindex, nofollow, noarchive' );
+                        }
+                        add_action( 'wp_head', 'wp_no_robots' );
+                        add_filter( 'pre_handle_404', array( $this, 'customize_changeset_preview_redirect' ), 1, 2 );
                 }
 
                 if ( ! headers_sent() ) {