Changeset 21136

Timestamp:

06/26/2012 06:53:45 PM (14 years ago)

Author:

nacin

Message:

Refresh nonces in the customizer. props koopersmith. see #20876 for 3.4.

Location:

branches/3.4

Files:

• wp-admin/customize.php (modified) (3 diffs)
• wp-admin/js/customize-controls.dev.js (modified) (10 diffs)
• wp-includes/class-wp-customize-manager.php (modified) (4 diffs)
• wp-includes/js/customize-preview.dev.js (modified) (1 diff)
• wp-login.php (modified) (4 diffs)

branches/3.4/wp-admin/customize.php

@@ -8 +8 @@
  */
 
+define( 'IFRAME_REQUEST', true );
+
 require_once( './admin.php' );
 if ( ! current_user_can( 'edit_theme_options' ) )
@@ -66 +68 @@
 <div class="wp-full-overlay expanded">
         <form id="customize-controls" class="wrap wp-full-overlay-sidebar">
-                <?php wp_nonce_field( 'customize_controls-' . $wp_customize->get_stylesheet() ); ?>
                 <div id="customize-header-actions" class="wp-full-overlay-header">
                         <?php
@@ -176 +177 @@
                 'settings' => array(),
                 'controls' => array(),
+                'nonce'    => array(
+                        'save'    => wp_create_nonce( 'save-customize_' . $wp_customize->get_stylesheet() ),
+                        'preview' => wp_create_nonce( 'preview-customize_' . $wp_customize->get_stylesheet() )
+                ),
         );
 

branches/3.4/wp-admin/js/customize-controls.dev.js

@@ -295 +295 @@
                         deferred.promise( this );
 
-                        this.previewer = params.previewer;
+                        this.container = params.container;
+                        this.signature = params.signature;
 
                         $.extend( params, { channel: api.PreviewFrame.uuid() });
@@ -339 +340 @@
                         this.request.done( function( response ) {
                                 var location = self.request.getResponseHeader('Location'),
-                                        signature = 'WP_CUSTOMIZER_SIGNATURE',
+                                        signature = self.signature,
                                         index;
 
@@ -372 +373 @@
 
                                 // Create the iframe and inject the html content.
-                                self.iframe = $('<iframe />').appendTo( self.previewer.container );
+                                self.iframe = $('<iframe />').appendTo( self.container );
 
                                 // Bind load event after the iframe has been added to the page;
@@ -417 +418 @@
 
                                 iframe = $('<iframe src="' + self.previewUrl() + '" />').hide();
-                                iframe.appendTo( self.previewer.container );
+                                iframe.appendTo( self.container );
                                 iframe.load( function() {
                                         self.triedLogin = true;
@@ -498 +499 @@
                         this.container   = api.ensure( params.container );
                         this.allowedUrls = params.allowedUrls;
+                        this.signature   = params.signature;
 
                         params.url = window.location.href;
@@ -571 +573 @@
                                 previewUrl: this.previewUrl(),
                                 query:      this.query() || {},
-                                previewer:  this
+                                container:  this.container,
+                                signature:  this.signature
                         });
 
@@ -584 +587 @@
                                         self.targetWindow( this.targetWindow() );
                                         self.channel( this.channel() );
+
+                                        self.send( 'active' );
                                 });
 
@@ -684 +689 @@
                         form:        '#customize-controls',
                         previewUrl:  api.settings.url.preview,
-                        allowedUrls: api.settings.url.allowed
+                        allowedUrls: api.settings.url.allowed,
+                        signature:   'WP_CUSTOMIZER_SIGNATURE'
                 }, {
+
+                        nonce: api.settings.nonce,
+
                         query: function() {
                                 return {
                                         wp_customize: 'on',
                                         theme:        api.settings.theme.stylesheet,
-                                        customized:   JSON.stringify( api.get() )
+                                        customized:   JSON.stringify( api.get() ),
+                                        nonce:        this.nonce.preview
                                 };
                         },
-
-                        nonce: $('#_wpnonce').val(),
 
                         save: function() {
@@ -700 +708 @@
                                         query = $.extend( this.query(), {
                                                 action: 'customize_save',
-                                                nonce:  this.nonce
+                                                nonce:  this.nonce.save
                                         }),
                                         request = $.post( api.settings.url.ajax, query );
@@ -733 +741 @@
                         }
                 });
+
+                // Refresh the nonces if the preview sends updated nonces over.
+                previewer.bind( 'nonce', function( nonce ) {
+                        $.extend( this.nonce, nonce );
+                });
 
                 $.each( api.settings.settings, function( id, data ) {

branches/3.4/wp-includes/class-wp-customize-manager.php

@@ -18 +18 @@
         protected $controls = array();
 
+        protected $nonce_tick;
+
         protected $customized;
 
@@ -309 +311 @@
          */
         public function customize_preview_init() {
+                $this->nonce_tick = check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce' );
+
                 $this->prepare_controls();
 
@@ -363 +367 @@
                 );
 
+                if ( 2 == $this->nonce_tick ) {
+                        $settings['nonce'] = array(
+                                'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
+                                'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() )
+                        );
+                }
+
                 foreach ( $this->settings as $id => $setting ) {
                         $settings['values'][ $id ] = $setting->js_value();
@@ -469 +480 @@
                         die;
 
-                check_ajax_referer( 'customize_controls-' . $this->get_stylesheet(), 'nonce' );
+                check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce' );
 
                 // Do we have to switch themes?

branches/3.4/wp-includes/js/customize-preview.dev.js

@@ -89 +89 @@
                         });
                         preview.send( 'synced' );
-                })
+                });
+
+                preview.bind( 'active', function() {
+                        if ( api.settings.nonce )
+                                preview.send( 'nonce', api.settings.nonce );
+                });
 
                 preview.send( 'ready' );

branches/3.4/wp-login.php

@@ -40 +40 @@
  */
 function login_header($title = 'Log In', $message = '', $wp_error = '') {
-        global $error, $interim_login, $current_site, $customize_login;
+        global $error, $interim_login, $current_site;
 
         // Don't index any of these forms
@@ -68 +68 @@
                 <meta name="viewport" content="width=320; initial-scale=0.9; maximum-scale=1.0; user-scalable=0;" /><?php
         }
-
-        if ( $customize_login )
-                wp_enqueue_script( 'customize-base' );
 
         do_action( 'login_enqueue_scripts' );
@@ -569 +566 @@
         $interim_login = isset($_REQUEST['interim-login']);
         $customize_login = isset( $_REQUEST['customize-login'] );
+        if ( $customize_login )
+                wp_enqueue_script( 'customize-base' );
 
         // If the user wants ssl but the session is not ssl, force a secure cookie.
@@ -605 +604 @@
                 if ( $interim_login ) {
                         $message = '<p class="message">' . __('You have logged in successfully.') . '</p>';
-                        login_header( '', $message );
-
-                        if ( ! $customize_login ) : ?>
-                                <script type="text/javascript">setTimeout( function(){window.close()}, 8000);</script>
-                                <p class="alignright">
-                                <input type="button" class="button-primary" value="<?php esc_attr_e('Close'); ?>" onclick="window.close()" /></p>
-<?php           endif;
-
-                        ?></div><?php
-
-                        do_action('login_footer');
-
-                        if ( $customize_login ) : ?>
+                        login_header( '', $message ); ?>
+
+                        <?php if ( ! $customize_login ) : ?>
+                        <script type="text/javascript">setTimeout( function(){window.close()}, 8000);</script>
+                        <p class="alignright">
+                        <input type="button" class="button-primary" value="<?php esc_attr_e('Close'); ?>" onclick="window.close()" /></p>
+                        <?php endif; ?>
+                        </div>
+                        <?php do_action( 'login_footer' ); ?>
+                        <?php if ( $customize_login ) : ?>
                                 <script type="text/javascript">setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
-<?php           endif; ?>
+                        <?php endif; ?>
                         </body></html>
 <?php           exit;