Changeset 21135

Timestamp:

06/26/2012 06:48:18 PM (12 years ago)

Author:

nacin

Message:

Refresh nonces in the customizer. props koopersmith. see #20876.

Location:

trunk

Files:

• wp-admin/customize.php (modified) (3 diffs)
• wp-admin/js/customize-controls.dev.js (modified) (10 diffs)
• wp-includes/class-wp-customize-manager.php (modified) (4 diffs)
• wp-includes/js/customize-preview.dev.js (modified) (1 diff)
• wp-login.php (modified) (4 diffs)

trunk/wp-admin/customize.php

@@ -8 +8 @@
  */
 
+define( 'IFRAME_REQUEST', true );
+
 require_once( './admin.php' );
 if ( ! current_user_can( 'edit_theme_options' ) )
@@ -66 +68 @@
 <div class="wp-full-overlay expanded">
     <form id="customize-controls" class="wrap wp-full-overlay-sidebar">
-        <?php wp_nonce_field( 'customize_controls-' . $wp_customize->get_stylesheet() ); ?>
         <div id="customize-header-actions" class="wp-full-overlay-header">
             <?php
@@ -176 +177 @@
         'settings' => array(),
         'controls' => array(),
+        'nonce'    => array(
+            'save'    => wp_create_nonce( 'save-customize_' . $wp_customize->get_stylesheet() ),
+            'preview' => wp_create_nonce( 'preview-customize_' . $wp_customize->get_stylesheet() )
+        ),
     );
 

trunk/wp-admin/js/customize-controls.dev.js

@@ -295 +295 @@
             deferred.promise( this );
 
-            this.previewer = params.previewer;
+            this.container = params.container;
+            this.signature = params.signature;
 
             $.extend( params, { channel: api.PreviewFrame.uuid() });
@@ -339 +340 @@
             this.request.done( function( response ) {
                 var location = self.request.getResponseHeader('Location'),
-                    signature = 'WP_CUSTOMIZER_SIGNATURE',
+                    signature = self.signature,
                     index;
 
@@ -372 +373 @@
 
                 // Create the iframe and inject the html content.
-                self.iframe = $('<iframe />').appendTo( self.previewer.container );
+                self.iframe = $('<iframe />').appendTo( self.container );
 
                 // Bind load event after the iframe has been added to the page;
@@ -417 +418 @@
 
                 iframe = $('<iframe src="' + self.previewUrl() + '" />').hide();
-                iframe.appendTo( self.previewer.container );
+                iframe.appendTo( self.container );
                 iframe.load( function() {
                     self.triedLogin = true;
@@ -498 +499 @@
             this.container   = api.ensure( params.container );
             this.allowedUrls = params.allowedUrls;
+            this.signature   = params.signature;
 
             params.url = window.location.href;
@@ -571 +573 @@
                 previewUrl: this.previewUrl(),
                 query:      this.query() || {},
-                previewer:  this
+                container:  this.container,
+                signature:  this.signature
             });
 
@@ -584 +587 @@
                     self.targetWindow( this.targetWindow() );
                     self.channel( this.channel() );
+
+                    self.send( 'active' );
                 });
 
@@ -684 +689 @@
             form:        '#customize-controls',
             previewUrl:  api.settings.url.preview,
-            allowedUrls: api.settings.url.allowed
+            allowedUrls: api.settings.url.allowed,
+            signature:   'WP_CUSTOMIZER_SIGNATURE'
         }, {
+
+            nonce: api.settings.nonce,
+
             query: function() {
                 return {
                     wp_customize: 'on',
                     theme:        api.settings.theme.stylesheet,
-                    customized:   JSON.stringify( api.get() )
+                    customized:   JSON.stringify( api.get() ),
+                    nonce:        this.nonce.preview
                 };
             },
-
-            nonce: $('#_wpnonce').val(),
 
             save: function() {
@@ -700 +708 @@
                     query = $.extend( this.query(), {
                         action: 'customize_save',
-                        nonce:  this.nonce
+                        nonce:  this.nonce.save
                     }),
                     request = $.post( api.settings.url.ajax, query );
@@ -733 +741 @@
             }
         });
+
+        // Refresh the nonces if the preview sends updated nonces over.
+        previewer.bind( 'nonce', function( nonce ) {
+            $.extend( this.nonce, nonce );
+        });
 
         $.each( api.settings.settings, function( id, data ) {

trunk/wp-includes/class-wp-customize-manager.php

@@ -18 +18 @@
     protected $controls = array();
 
+    protected $nonce_tick;
+
     protected $customized;
 
@@ -309 +311 @@
      */
     public function customize_preview_init() {
+        $this->nonce_tick = check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce' );
+
         $this->prepare_controls();
 
@@ -363 +367 @@
         );
 
+        if ( 2 == $this->nonce_tick ) {
+            $settings['nonce'] = array(
+                'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
+                'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() )
+            );
+        }
+
         foreach ( $this->settings as $id => $setting ) {
             $settings['values'][ $id ] = $setting->js_value();
@@ -469 +480 @@
             die;
 
-        check_ajax_referer( 'customize_controls-' . $this->get_stylesheet(), 'nonce' );
+        check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce' );
 
         // Do we have to switch themes?

trunk/wp-includes/js/customize-preview.dev.js

@@ -89 +89 @@
             });
             preview.send( 'synced' );
-        })
+        });
+
+        preview.bind( 'active', function() {
+            if ( api.settings.nonce )
+                preview.send( 'nonce', api.settings.nonce );
+        });
 
         preview.send( 'ready' );

trunk/wp-login.php

@@ -40 +40 @@
  */
 function login_header($title = 'Log In', $message = '', $wp_error = '') {
-    global $error, $interim_login, $current_site, $customize_login;
+    global $error, $interim_login, $current_site;
 
     // Don't index any of these forms
@@ -68 +68 @@
         <meta name="viewport" content="width=320; initial-scale=0.9; maximum-scale=1.0; user-scalable=0;" /><?php
     }
-
-    if ( $customize_login )
-        wp_enqueue_script( 'customize-base' );
 
     do_action( 'login_enqueue_scripts' );
@@ -569 +566 @@
     $interim_login = isset($_REQUEST['interim-login']);
     $customize_login = isset( $_REQUEST['customize-login'] );
+    if ( $customize_login )
+        wp_enqueue_script( 'customize-base' );
 
     // If the user wants ssl but the session is not ssl, force a secure cookie.
@@ -605 +604 @@
         if ( $interim_login ) {
             $message = '<p class="message">' . __('You have logged in successfully.') . '</p>';
-            login_header( '', $message );
-
-            if ( ! $customize_login ) : ?>
-                <script type="text/javascript">setTimeout( function(){window.close()}, 8000);</script>
-                <p class="alignright">
-                <input type="button" class="button-primary" value="<?php esc_attr_e('Close'); ?>" onclick="window.close()" /></p>
-<?php       endif;
-
-            ?></div><?php
-
-            do_action('login_footer');
-
-            if ( $customize_login ) : ?>
+            login_header( '', $message ); ?>
+
+            <?php if ( ! $customize_login ) : ?>
+            <script type="text/javascript">setTimeout( function(){window.close()}, 8000);</script>
+            <p class="alignright">
+            <input type="button" class="button-primary" value="<?php esc_attr_e('Close'); ?>" onclick="window.close()" /></p>
+            <?php endif; ?>
+            </div>
+            <?php do_action( 'login_footer' ); ?>
+            <?php if ( $customize_login ) : ?>
                 <script type="text/javascript">setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
-<?php       endif; ?>
+            <?php endif; ?>
             </body></html>
 <?php       exit;