Changeset 27819

Timestamp:

03/28/2014 03:34:17 PM (9 years ago)

Author:

ocean90

Message:

Widget Customizer: Simplify nonces.

see #27534.

Location:

trunk/src

Files:

• wp-admin/js/customize-widgets.js (modified) (2 diffs)
• wp-includes/class-wp-customize-widgets.php (modified) (5 diffs)

trunk/src/wp-admin/js/customize-widgets.js

@@ -10 +10 @@
         OldPreviewer,
         customize = wp.customize, self = {
-        update_widget_ajax_action: null,
-        update_widget_nonce_value: null,
-        update_widget_nonce_post_key: null,
+        nonce: null,
         i18n: {
             save_btn_label: '',
@@ -1202 +1200 @@
 
             params = {};
-            params.action = self.update_widget_ajax_action;
+            params.action = 'update-widget';
             params.wp_customize = 'on';
-            params[self.update_widget_nonce_post_key] = self.update_widget_nonce_value;
+            params.nonce = self.nonce;
 
             data = $.param( params );

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -134 +134 @@
             $this->get_post_value( 'action' ) === 'update-widget'
             &&
-            check_ajax_referer( 'update-widget', 'update-widget-nonce', false )
+            check_ajax_referer( 'update-widget', 'nonce', false )
         );
 
@@ -142 +142 @@
             $this->get_post_value( 'action' ) === 'customize_save'
             &&
-            check_ajax_referer( 'save-customize_' . $this->manager->get_stylesheet(), 'nonce' )
+            check_ajax_referer( 'save-customize_' . $this->manager->get_stylesheet(), 'nonce', false )
         );
 
@@ -575 +575 @@
         global $wp_scripts;
         $exports = array(
-            'update_widget_ajax_action' => 'update-widget',
-            'update_widget_nonce_value' => wp_create_nonce( 'update-widget' ),
-            'update_widget_nonce_post_key' => 'update-widget-nonce',
+            'nonce' => wp_create_nonce( 'update-widget' ),
             'registered_sidebars' => array_values( $GLOBALS['wp_registered_sidebars'] ),
             'registered_widgets' => $GLOBALS['wp_registered_widgets'],
@@ -1160 +1158 @@
         }
 
-        check_ajax_referer( 'update-widget', 'update-widget-nonce' );
+        check_ajax_referer( 'update-widget', 'nonce' );
 
         if ( ! current_user_can( 'edit_theme_options' ) ) {
@@ -1169 +1167 @@
             wp_send_json_error();
         }
-
-        unset( $_POST['update-widget-nonce'], $_POST['action'] );
 
         do_action( 'load-widgets.php' );