Changeset 24528

Timestamp:

06/29/2013 01:31:44 AM (13 years ago)

Author:

azaozz

Message:

Nonce refresh:

• Update the heartbeat nonce when refreshing nonces on the Edit Post screen.
• After a user logs in from the auth-check dialog, speed up heatrbeat to check/refresh nonces on the Edit Post screen.
• Speeding up heartbeat: bring back the setting how long it should last (how many ticks).
• Add 'heartbeat-nonces-expired' jQuery event when nonces have expired and the user is logged in.

See #23295, see #23216.

Location:

trunk

Files:

• wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• wp-admin/includes/misc.php (modified) (1 diff)
• wp-admin/js/post.js (modified) (2 diffs)
• wp-includes/js/heartbeat.js (modified) (6 diffs)
• wp-includes/js/wp-auth-check.js (modified) (4 diffs)

trunk/wp-admin/includes/ajax-actions.php

@@ -2055 +2055 @@
 
 function wp_ajax_heartbeat() {
-        check_ajax_referer( 'heartbeat-nonce', '_nonce' );
+        if ( empty( $_POST['_nonce'] ) )
+                wp_send_json_error();
+
         $response = array();
+
+        if ( false === wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' ) ) {
+                // User is logged in but nonces have expired.
+                $response['nonces_expired'] = true;
+                wp_send_json($response);
+        }
 
         // screen_id is the same as $current_screen->id and the JS global 'pagenow'
@@ -2077 +2085 @@
         do_action( 'heartbeat_tick', $response, $screen_id );
 
-        // send the current time acording to the server
+        // Send the current time acording to the server
         $response['server_time'] = time();
 

trunk/wp-admin/includes/misc.php

@@ -640 +640 @@
         if ( array_key_exists( 'wp-refresh-post-nonces', $data ) ) {
                 $received = $data['wp-refresh-post-nonces'];
+                $response['wp-refresh-post-nonces'] = array( 'check' => 1 );
 
                 if ( ! $post_id = absint( $received['post_id'] ) )
                         return $response;
 
-                if ( ! current_user_can('edit_post', $post_id) )
+                if ( ! current_user_can( 'edit_post', $post_id ) || empty( $received['post_nonce'] ) )
                         return $response;
 
-                if ( ! empty( $received['post_nonce'] ) && 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
+                if ( 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
                         $response['wp-refresh-post-nonces'] = array(
-                                'replace-autosavenonce' => wp_create_nonce('autosave'),
-                                'replace-getpermalinknonce' => wp_create_nonce('getpermalink'),
-                                'replace-samplepermalinknonce' => wp_create_nonce('samplepermalink'),
-                                'replace-closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
-                                'replace-_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
-                                'replace-_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
+                                'replace' => array(
+                                        'autosavenonce' => wp_create_nonce('autosave'),
+                                        'getpermalinknonce' => wp_create_nonce('getpermalink'),
+                                        'samplepermalinknonce' => wp_create_nonce('samplepermalink'),
+                                        'closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
+                                        '_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
+                                        '_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
+                                ),
+                                'heartbeatNonce' => wp_create_nonce( 'heartbeat-nonce' ),
                         );
                 }

trunk/wp-admin/js/post.js

@@ -317 +317 @@
                 check = false;
                 window.clearTimeout( timeout );
-                timeout = window.setTimeout( function(){ check = 1; }, 3600000 );
+                timeout = window.setTimeout( function(){ check = true; }, 300000 );
         }
 
@@ -330 +330 @@
                                 };
                         }
-                        check = 2;
                 }
         }).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
-                if ( check === 2 )
+                var nonces = data['wp-refresh-post-nonces'];
+
+                if ( nonces ) {
                         schedule();
 
-                if ( data['wp-refresh-post-nonces'] ) {
-                        $.each( data['wp-refresh-post-nonces'], function( selector, value ) {
-                                if ( selector.match(/^replace-/) )
-                                        $( '#' + selector.replace('replace-', '') ).val( value );
-                        });
+                        if ( nonces.replace ) {
+                                $.each( nonces.replace, function( selector, value ) {
+                                        $( '#' + selector ).val( value );
+                                });
+                        }
+
+                        if ( nonces.heartbeatNonce )
+                                window.heartbeatSettings.nonce = nonces.heartbeatNonce;
                 }
         }).ready( function() {

trunk/wp-includes/js/heartbeat.js

@@ -11 +11 @@
                         running,
                         beat,
-                        nonce,
                         screenId = typeof pagenow != 'undefined' ? pagenow : '',
                         url = typeof ajaxurl != 'undefined' ? ajaxurl : '',
@@ -31 +30 @@
                 this.connectionLost = false;
 
-                if ( typeof( window.heartbeatSettings ) != 'undefined' ) {
-                        settings = window.heartbeatSettings;
+                if ( typeof( window.heartbeatSettings ) == 'object' ) {
+                        settings = $.extend( {}, window.heartbeatSettings );
 
                         // Add private vars
-                        nonce = settings.nonce || '';
-                        delete settings.nonce;
-
                         url = settings.ajaxurl || url;
                         delete settings.ajaxurl;
+                        delete settings.nonce;
 
                         interval = settings.interval || 15; // default interval
@@ -121 +118 @@
 
                 function connect() {
-                        var send = {}, data, i, empty = true;
+                        var send = {}, data, i, empty = true,
+                        nonce = typeof window.heartbeatSettings == 'object' ? window.heartbeatSettings.nonce : '';
                         tick = time();
 
@@ -168 +166 @@
                                 if ( self.connectionLost )
                                         errorstate();
+
+                                if ( response.nonces_expired ) {
+                                        $(document).trigger( 'heartbeat-nonces-expired' );
+                                        return;
+                                }
 
                                 // Change the interval from PHP
@@ -335 +338 @@
                  *
                  * @param string speed Interval speed: 'fast' (5sec), 'standard' (15sec) default, 'slow' (60sec)
+                 * @param string ticks Used with speed = 'fast', how many ticks before the speed reverts back
                  * @return int Current interval in seconds
                  */
-                this.interval = function( speed ) {
+                this.interval = function( speed, ticks ) {
                         var reset, seconds;
+                        ticks = parseInt( ticks, 10 ) || 30;
+                        ticks = ticks < 1 || ticks > 30 ? 30 : ticks;
 
                         if ( speed ) {
@@ -344 +350 @@
                                         case 'fast':
                                                 seconds = 5;
-                                                countdown = 30;
+                                                countdown = ticks;
                                                 break;
                                         case 'slow':

trunk/wp-includes/js/wp-auth-check.js

@@ -1 +1 @@
 // Interim login dialog
 (function($){
-        var wrap, check, timeout;
+        var wrap, check, scheduleTimeout, hideTimeout;
 
         function show() {
@@ -33 +33 @@
                                                 parent.find('.wp-auth-check-close').show();
                                                 wrap.data('logged-in', 1);
-                                                setTimeout( function() { hide(); }, 3000 );
+                                                hideTimeout = setTimeout( function() { hide(); }, 3000 );
                                         }
 
@@ -63 +63 @@
         function hide() {
                 $(window).off( 'beforeunload.wp-auth-check' );
+                window.clearTimeout( hideTimeout );
+
+                // When on the Edit Post screen, speed up heartbeat after the user logs in to quickly refresh nonces
+                if ( typeof adminpage != 'undefined' && ( adminpage == 'post-php' || adminpage == 'post-new-php' )
+                         && typeof wp != 'undefined' && wp.heartbeat ) {
+
+                        wp.heartbeat.interval( 'fast', 1 );
+                }
 
                 wrap.fadeOut( 200, function() {
@@ -72 +80 @@
         function schedule() {
                 check = false;
-                window.clearTimeout( timeout );
-                timeout = window.setTimeout( function(){ check = 1; }, 180000 ); // 3 min.
+                window.clearTimeout( scheduleTimeout );
+                scheduleTimeout = window.setTimeout( function(){ check = 1; }, 300000 ); // 5 min.
         }