Changeset 21010 for trunk/wp-includes/class-wp-customize-manager.php

Timestamp:

06/06/2012 08:34:24 PM (13 years ago)

Author:

nacin

Message:

Theme Customizer: Block non-existent or non-allowed themes, unless the non-allowed theme is the active theme. Support a user having edit_theme_options xor switch_themes. fixes #20852.

File:

• trunk/wp-includes/class-wp-customize-manager.php (modified) (3 diffs)

trunk/wp-includes/class-wp-customize-manager.php

@@ -79 +79 @@
      */
     public function setup_theme() {
-        if ( ! ( isset( $_REQUEST['customize'] ) && 'on' == $_REQUEST['customize'] ) && ! basename( $_SERVER['PHP_SELF'] ) == 'customize.php' )
-            return;
-
         send_origin_headers();
+
+        $this->original_stylesheet = get_stylesheet();
+
+        $this->theme = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
+
+        // You can't preview a theme if it doesn't exist, or if it is not allowed (unless active).
+        if ( ! $this->theme->exists() )
+            wp_die( __( 'Cheatin’ uh?' ) );
+
+        if ( $this->theme->get_stylesheet() != get_stylesheet() && ( ! $this->theme()->is_allowed() || ! current_user_can( 'switch_themes' ) ) )
+            wp_die( __( 'Cheatin’ uh?' ) );
+
+        if ( ! current_user_can( 'edit_theme_options' ) )
+            wp_die( __( 'Cheatin’ uh?' ) );
 
         $this->start_previewing_theme();
@@ -96 +107 @@
      */
     public function start_previewing_theme() {
-        if ( $this->is_preview() || false === $this->theme || ( $this->theme && ! $this->theme->exists() ) )
+        // Bail if we're already previewing.
+        if ( $this->is_preview() )
             return;
-
-        // Initialize $theme and $original_stylesheet if they do not yet exist.
-        if ( ! isset( $this->theme ) ) {
-            $this->theme = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
-            if ( ! $this->theme->exists() ) {
-                $this->theme = false;
-                return;
-            }
-        }
-
-        $this->original_stylesheet = get_stylesheet();
 
         $this->previewing = true;
@@ -420 +421 @@
             die;
 
-        check_ajax_referer( 'customize_controls', 'nonce' );
+        check_ajax_referer( 'customize_controls-' . $this->get_stylesheet(), 'nonce' );
 
         // Do we have to switch themes?
         if ( $this->get_stylesheet() != $this->original_stylesheet ) {
-            if ( ! current_user_can( 'switch_themes' ) )
-                die;
-
             // Temporarily stop previewing the theme to allow switch_themes()
             // to operate properly.