Changeset 24528

Timestamp:

06/29/2013 01:31:44 AM (11 years ago)

Author:

azaozz

Message:

Nonce refresh:

• Update the heartbeat nonce when refreshing nonces on the Edit Post screen.
• After a user logs in from the auth-check dialog, speed up heatrbeat to check/refresh nonces on the Edit Post screen.
• Speeding up heartbeat: bring back the setting how long it should last (how many ticks).
• Add 'heartbeat-nonces-expired' jQuery event when nonces have expired and the user is logged in.

See #23295, see #23216.

Location:

trunk

Files:

• wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• wp-admin/includes/misc.php (modified) (1 diff)
• wp-admin/js/post.js (modified) (2 diffs)
• wp-includes/js/heartbeat.js (modified) (6 diffs)
• wp-includes/js/wp-auth-check.js (modified) (4 diffs)

trunk/wp-admin/includes/ajax-actions.php

@@ -2055 +2055 @@
 
 function wp_ajax_heartbeat() {
-    check_ajax_referer( 'heartbeat-nonce', '_nonce' );
+    if ( empty( $_POST['_nonce'] ) )
+        wp_send_json_error();
+
     $response = array();
+
+    if ( false === wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' ) ) {
+        // User is logged in but nonces have expired.
+        $response['nonces_expired'] = true;
+        wp_send_json($response);
+    }
 
     // screen_id is the same as $current_screen->id and the JS global 'pagenow'
@@ -2077 +2085 @@
     do_action( 'heartbeat_tick', $response, $screen_id );
 
-    // send the current time acording to the server
+    // Send the current time acording to the server
     $response['server_time'] = time();
 

trunk/wp-admin/includes/misc.php

@@ -640 +640 @@
     if ( array_key_exists( 'wp-refresh-post-nonces', $data ) ) {
         $received = $data['wp-refresh-post-nonces'];
+        $response['wp-refresh-post-nonces'] = array( 'check' => 1 );
 
         if ( ! $post_id = absint( $received['post_id'] ) )
             return $response;
 
-        if ( ! current_user_can('edit_post', $post_id) )
+        if ( ! current_user_can( 'edit_post', $post_id ) || empty( $received['post_nonce'] ) )
             return $response;
 
-        if ( ! empty( $received['post_nonce'] ) && 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
+        if ( 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
             $response['wp-refresh-post-nonces'] = array(
-                'replace-autosavenonce' => wp_create_nonce('autosave'),
-                'replace-getpermalinknonce' => wp_create_nonce('getpermalink'),
-                'replace-samplepermalinknonce' => wp_create_nonce('samplepermalink'),
-                'replace-closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
-                'replace-_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
-                'replace-_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
+                'replace' => array(
+                    'autosavenonce' => wp_create_nonce('autosave'),
+                    'getpermalinknonce' => wp_create_nonce('getpermalink'),
+                    'samplepermalinknonce' => wp_create_nonce('samplepermalink'),
+                    'closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
+                    '_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
+                    '_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
+                ),
+                'heartbeatNonce' => wp_create_nonce( 'heartbeat-nonce' ),
             );
         }

trunk/wp-admin/js/post.js

@@ -317 +317 @@
         check = false;
         window.clearTimeout( timeout );
-        timeout = window.setTimeout( function(){ check = 1; }, 3600000 );
+        timeout = window.setTimeout( function(){ check = true; }, 300000 );
     }
 
@@ -330 +330 @@
                 };
             }
-            check = 2;
         }
     }).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
-        if ( check === 2 )
+        var nonces = data['wp-refresh-post-nonces'];
+
+        if ( nonces ) {
             schedule();
 
-        if ( data['wp-refresh-post-nonces'] ) {
-            $.each( data['wp-refresh-post-nonces'], function( selector, value ) {
-                if ( selector.match(/^replace-/) )
-                    $( '#' + selector.replace('replace-', '') ).val( value );
-            });
+            if ( nonces.replace ) {
+                $.each( nonces.replace, function( selector, value ) {
+                    $( '#' + selector ).val( value );
+                });
+            }
+
+            if ( nonces.heartbeatNonce )
+                window.heartbeatSettings.nonce = nonces.heartbeatNonce;
         }
     }).ready( function() {

trunk/wp-includes/js/heartbeat.js

@@ -11 +11 @@
             running,
             beat,
-            nonce,
             screenId = typeof pagenow != 'undefined' ? pagenow : '',
             url = typeof ajaxurl != 'undefined' ? ajaxurl : '',
@@ -31 +30 @@
         this.connectionLost = false;
 
-        if ( typeof( window.heartbeatSettings ) != 'undefined' ) {
-            settings = window.heartbeatSettings;
+        if ( typeof( window.heartbeatSettings ) == 'object' ) {
+            settings = $.extend( {}, window.heartbeatSettings );
 
             // Add private vars
-            nonce = settings.nonce || '';
-            delete settings.nonce;
-
             url = settings.ajaxurl || url;
             delete settings.ajaxurl;
+            delete settings.nonce;
 
             interval = settings.interval || 15; // default interval
@@ -121 +118 @@
 
         function connect() {
-            var send = {}, data, i, empty = true;
+            var send = {}, data, i, empty = true,
+            nonce = typeof window.heartbeatSettings == 'object' ? window.heartbeatSettings.nonce : '';
             tick = time();
 
@@ -168 +166 @@
                 if ( self.connectionLost )
                     errorstate();
+
+                if ( response.nonces_expired ) {
+                    $(document).trigger( 'heartbeat-nonces-expired' );
+                    return;
+                }
 
                 // Change the interval from PHP
@@ -335 +338 @@
          *
          * @param string speed Interval speed: 'fast' (5sec), 'standard' (15sec) default, 'slow' (60sec)
+         * @param string ticks Used with speed = 'fast', how many ticks before the speed reverts back
          * @return int Current interval in seconds
          */
-        this.interval = function( speed ) {
+        this.interval = function( speed, ticks ) {
             var reset, seconds;
+            ticks = parseInt( ticks, 10 ) || 30;
+            ticks = ticks < 1 || ticks > 30 ? 30 : ticks;
 
             if ( speed ) {
@@ -344 +350 @@
                     case 'fast':
                         seconds = 5;
-                        countdown = 30;
+                        countdown = ticks;
                         break;
                     case 'slow':

trunk/wp-includes/js/wp-auth-check.js

@@ -1 +1 @@
 // Interim login dialog
 (function($){
-    var wrap, check, timeout;
+    var wrap, check, scheduleTimeout, hideTimeout;
 
     function show() {
@@ -33 +33 @@
                         parent.find('.wp-auth-check-close').show();
                         wrap.data('logged-in', 1);
-                        setTimeout( function() { hide(); }, 3000 );
+                        hideTimeout = setTimeout( function() { hide(); }, 3000 );
                     }
 
@@ -63 +63 @@
     function hide() {
         $(window).off( 'beforeunload.wp-auth-check' );
+        window.clearTimeout( hideTimeout );
+
+        // When on the Edit Post screen, speed up heartbeat after the user logs in to quickly refresh nonces
+        if ( typeof adminpage != 'undefined' && ( adminpage == 'post-php' || adminpage == 'post-new-php' )
+             && typeof wp != 'undefined' && wp.heartbeat ) {
+
+            wp.heartbeat.interval( 'fast', 1 );
+        }
 
         wrap.fadeOut( 200, function() {
@@ -72 +80 @@
     function schedule() {
         check = false;
-        window.clearTimeout( timeout );
-        timeout = window.setTimeout( function(){ check = 1; }, 180000 ); // 3 min.
+        window.clearTimeout( scheduleTimeout );
+        scheduleTimeout = window.setTimeout( function(){ check = 1; }, 300000 ); // 5 min.
     }