Ticket #50781: 50781.3.patch

src/wp-includes/class-wp-customize-manager.php

@@ -492 +492 @@
 
                 return '_default_wp_die_handler';
         }
+        /**
+         * Redirects a URL to the 404 page if changeset UUID does not exists
+         *
+         * @since 5.6.0
+         *
+         * @param bool     $bypass Pass-through of the pre_handle_404 filter value.
+         * @param WP_Query $query  The WP_Query object.
+         * @return bool Bypass value.
+         */
+        public function customize_changeset_preview_redirect( $bypass, $query ) {
+                // If a theme/plugin has already utilized the pre_handle_404 function, return without action to avoid conflicts.
+                if ( $bypass ) {
+                        return $bypass;
+                }
 
+                $query->set_404();
+                status_header( 404 );
+                return $bypass;
+        }
         /**
          * Start preview and customize theme.
          *
@@ -521 +539 @@
 
                 // If a changeset was provided is invalid.
                 if ( isset( $this->_changeset_uuid ) && false !== $this->_changeset_uuid && ! wp_is_uuid( $this->_changeset_uuid ) ) {
+                        if ( ! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) { //Adding pre_handle_404 for unauthenticated Invalid changeset UUID
+                                 add_filter( 'pre_handle_404', array( $this, 'customize_changeset_preview_redirect' ), 10, 2 );
+                        } else {
                         $this->wp_die( -1, __( 'Invalid changeset UUID' ) );
+                    }
                 }
 
                 /*