Changeset 20925

Timestamp:

05/26/2012 04:08:44 AM (14 years ago)

Author:

koopersmith

Message:

Theme Customizer: Add a signature to preview requests to be super-double-ultra-sure that the customizer generated the preview. Redirects can be sneaky. fixes #20507, see #19910.

Location:

trunk/wp-includes

Files:

• class-wp-customize-manager.php (modified) (2 diffs)
• js/customize-controls.dev.js (modified) (2 diffs)

trunk/wp-includes/class-wp-customize-manager.php

@@ -265 +265 @@
                 add_action( 'wp_head', array( $this, 'customize_preview_base' ) );
                 add_action( 'wp_footer', array( $this, 'customize_preview_settings' ), 20 );
+                add_action( 'shutdown', array( $this, 'customize_preview_signature' ), 1000 );
 
                 foreach ( $this->settings as $setting ) {
@@ -301 +302 @@
                 </script>
                 <?php
+        }
+
+        /**
+         * Prints a signature so we can ensure the customizer was properly executed.
+         *
+         * @since 3.4.0
+         */
+        public function customize_preview_signature() {
+                echo 'WP_CUSTOMIZER_SIGNATURE';
         }
 

trunk/wp-includes/js/customize-controls.dev.js

@@ -406 +406 @@
                                 success: function( response ) {
                                         var iframe = self.loader()[0].contentWindow,
-                                                location = self.request.getResponseHeader('Location');
+                                                location = self.request.getResponseHeader('Location'),
+                                                signature = 'WP_CUSTOMIZER_SIGNATURE',
+                                                index;
 
                                         // Check if the location response header differs from the current URL.
@@ -414 +416 @@
                                                 return;
                                         }
+
+                                        // Check for a signature in the request.
+                                        index = response.lastIndexOf( signature );
+                                        if ( -1 === index || index < response.lastIndexOf('</html>') )
+                                                return;
+
+                                        // Strip the signature from the request.
+                                        response = response.slice( 0, index ) + response.slice( index + signature.length );
 
                                         self.loader().one( 'load', self.loaded );