Ticket #50781: 50781.patch

class-wp-customize-manager.php

@@ -492 +492 @@
 
                 return '_default_wp_die_handler';
         }
-
         /**
+         * Redirects a URL to the 404 page if changeset UUID does not exists for unauthenticated users
+         *
+         * @since 5.5.0
+         *
+         * @param bool     $bypass Pass-through of the pre_handle_404 filter value.
+         * @param WP_Query $query  The WP_Query object.
+         * @return bool Bypass value.
+         */
+        public function customize_changeset_preview_redirect( $bypass, $query ) {
+                $query->set_404();
+                status_header(404);
+                return $bypass;
+        }
+        /**
          * Start preview and customize theme.
          *
          * Check if customize query variable exist. Init filters to filter the current theme.
@@ -547 +560 @@
                  * In this way, the UUID serves as a secret key. If the messenger channel is present,
                  * then send unauthenticated code to prompt re-auth.
                  */
-                if ( ! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) {
-                        $this->wp_die( $this->messenger_channel ? 0 : -1, __( 'Non-existent changeset UUID.' ) );
-                }
-
+                if (! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) {
+                /*
+                 * As this is a preview page sending noindex in headers.
+                 */
+                        if ( ! headers_sent() ) {
+                                nocache_headers();
+                                header( 'X-Robots: noindex, nofollow, noarchive' );
+                        }
+                        add_action( 'wp_head', 'wp_no_robots' );
+                    add_filter( 'pre_handle_404', array( $this, 'customize_changeset_preview_redirect' ), 1, 2 );
+        }
                 if ( ! headers_sent() ) {
                         send_origin_headers();
                 }