Changeset 28126

Timestamp:

04/15/2014 01:15:43 AM (10 years ago)

Author:

nacin

Message:

Theme Installer: Revert to proxying through PHP for WordPress.org API requests.

This is to ensure we have valid installation nonces, though we've run into this as a problem previously (see #27639, #27581, #27055).

A tad slower, but we gained speed in 3.9 by simplifying the request made to the API.

props ocean90.
fixes #27798.

Location:

trunk/src/wp-admin

Files:

• admin-ajax.php (modified) (1 diff)
• includes/ajax-actions.php (modified) (1 diff)
• includes/theme.php (modified) (1 diff)
• js/theme.js (modified) (10 diffs)
• theme-install.php (modified) (5 diffs)
• update.php (modified) (1 diff)

trunk/src/wp-admin/admin-ajax.php

@@ -59 +59 @@
     'query-attachments', 'save-attachment', 'save-attachment-compat', 'send-link-to-editor',
     'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs',
-    'save-user-color-scheme', 'update-widget',
+    'save-user-color-scheme', 'update-widget', 'query-themes',
 );
 

trunk/src/wp-admin/includes/ajax-actions.php

@@ -2205 +2205 @@
     wp_send_json_success();
 }
+
+/**
+ * Get themes from themes_api().
+ *
+ * @since 3.9.0
+ */
+function wp_ajax_query_themes() {
+    global $themes_allowedtags, $theme_field_defaults;
+
+    if ( ! current_user_can( 'install_themes' ) ) {
+        wp_send_json_error();
+    }
+
+    $args = wp_parse_args( wp_unslash( $_REQUEST['request'] ), array(
+        'per_page' => 20,
+        'fields'   => $theme_field_defaults
+    ) );
+
+    $old_filter = isset( $args['browse'] ) ? $args['browse'] : 'search';
+
+    /** This filter is documented in wp-admin/includes/class-wp-theme-install-list-table.php */
+    $args = apply_filters( 'install_themes_table_api_args_' . $old_filter, $args );
+
+    $api = themes_api( 'query_themes', $args );
+
+    if ( is_wp_error( $api ) ) {
+        wp_send_json_error();
+    }
+
+    $update_php = self_admin_url( 'update.php?action=install-theme' );
+    foreach ( $api->themes as &$theme ) {
+        $theme->install_url = add_query_arg( array(
+            'theme'    => $theme->slug,
+            '_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug )
+        ), $update_php );
+
+        $theme->name        = wp_kses( $theme->name, $themes_allowedtags );
+        $theme->author      = wp_kses( $theme->author, $themes_allowedtags );
+        $theme->version     = wp_kses( $theme->version, $themes_allowedtags );
+        $theme->description = wp_kses( $theme->description, $themes_allowedtags );
+        $theme->num_ratings = sprintf( _n( '(based on %s rating)', '(based on %s ratings)', $theme->num_ratings ), number_format_i18n( $theme->num_ratings ) );
+    }
+
+    wp_send_json_success( $api );
+}

trunk/src/wp-admin/includes/theme.php

@@ -347 +347 @@
 
         if ( $ssl && is_wp_error( $request ) ) {
-            trigger_error( __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' ) . ' ' . '(WordPress could not establish a secure connection to WordPress.org. Please contact your server administrator.)', headers_sent() || WP_DEBUG ? E_USER_WARNING : E_USER_NOTICE );
+            if ( ! defined( 'DOING_AJAX' ) || ! DOING_AJAX ) {
+                trigger_error( __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' ) . ' ' . '(WordPress could not establish a secure connection to WordPress.org. Please contact your server administrator.)', headers_sent() || WP_DEBUG ? E_USER_WARNING : E_USER_NOTICE );
+            }
             $request = wp_remote_post( $http_url, $args );
         }

trunk/src/wp-admin/js/theme.js

@@ -23 +23 @@
     // Map `id` to `slug` for shared code
     initialize: function() {
-        var install, description;
-
-        // Install url for the theme
-        // using the install nonce
-        install = {
-            action: 'install-theme',
-            theme: this.get( 'slug' ),
-            _wpnonce: themes.data.settings._nonceInstall
-        };
-
-        // Build the url query
-        install = themes.data.settings.updateURI + '?' + $.param( install );
+        var description;
 
         // If theme is already installed, set an attribute.
@@ -43 +32 @@
         // Set the attributes
         this.set({
-            installURI: ( this.get( 'slug' ) ) ? install : false,
             // slug is for installation, id is for existing.
             id: this.get( 'slug' ) || this.get( 'id' )
@@ -226 +214 @@
     // When we are missing a cache object we fire an apiCall()
     // which triggers events of `query:success` or `query:fail`
-    query: function( request, action ) {
+    query: function( request ) {
         /**
          * @static
@@ -255 +243 @@
         // Otherwise, send a new API call and add it to the cache.
         if ( ! query && ! isPaginated ) {
-            query = this.apiCall( request, action ).done( function( data ) {
+            query = this.apiCall( request ).done( function( data ) {
 
                 // Update the collection with the queried data.
@@ -263 +251 @@
                     // Store the results and the query request
                     queries.push( { themes: data.themes, request: request, total: count } );
-
-                } else if ( action ) {
-                    self.reset( data );
-                    count = 1;
-                    self.trigger( 'query:theme' );
                 }
 
@@ -285 +268 @@
             // If it's a paginated request we need to fetch more themes...
             if ( isPaginated ) {
-                return this.apiCall( request, action, isPaginated ).done( function( data ) {
+                return this.apiCall( request, isPaginated ).done( function( data ) {
                     // Add the new themes to the current collection
                     // @todo update counter
@@ -311 +294 @@
             }
 
+            this.reset( query.themes );
             if ( ! query.total ) {
                 this.count = this.length;
             }
 
-            this.reset( query.themes );
             this.trigger( 'update' );
+            this.trigger( 'query:success', this.count );
         }
     },
@@ -330 +314 @@
 
     // Send request to api.wordpress.org/themes
-    apiCall: function( request, action, paginated ) {
-
-        // Send tags (and fields) as comma-separated to keep the JSONP query string short.
-        if ( request.tag && _.isArray( request.tag ) ) {
-            request.tag = request.tag.join( ',' );
-        }
-
-        // Set request action
-        if ( ! action ) {
-            action = 'query_themes'
-        }
-
-        // JSONP request to .org API
-        return $.ajax({
-            url: 'https://api.wordpress.org/themes/info/1.1/?callback=?',
-            dataType: 'jsonp',
-            timeout: 15000, // 15 seconds
-
+    apiCall: function( request, paginated ) {
+        return wp.ajax.send( 'query-themes', {
+            data: {
             // Request data
-            data: {
-                action: action,
                 request: _.extend({
-                    per_page: 72,
-                    fields: 'description,tested,requires,rating,downloaded,downloadLink,last_updated,homepage,num_ratings'
+                    per_page: 100,
+                    fields: {
+                        description: true,
+                        tested: true,
+                        requires: true,
+                        rating: true,
+                        downloaded: true,
+                        downloadLink: true,
+                        last_updated: true,
+                        homepage: true,
+                        num_ratings: true
+                    }
                 }, request)
             },
@@ -1568 +1545 @@
     },
 
-    backToFilters: function() {
+    backToFilters: function( event ) {
+        if ( event ) {
+            event.preventDefault();
+        }
+
         $( 'body' ).removeClass( 'filters-applied' );
     },
@@ -1635 +1616 @@
         // Queries the API for the passed theme slug
         themes.router.on( 'route:preview', function( slug ) {
-            request.slug = slug;
-            self.view.collection.query( request, 'theme_information' );
+            request.theme = slug;
+            self.view.collection.query( request );
         });
 

trunk/src/wp-admin/theme-install.php

@@ -47 +47 @@
         'canInstall'    => current_user_can( 'install_themes' ),
         'installURI'    => current_user_can( 'install_themes' ) ? self_admin_url( 'theme-install.php' ) : null,
-        'adminUrl'      => parse_url( self_admin_url(), PHP_URL_PATH ),
-        'updateURI'     => self_admin_url( 'update.php' ),
-        '_nonceInstall' => wp_create_nonce( 'install-theme' )
+        'adminUrl'      => parse_url( self_admin_url(), PHP_URL_PATH )
     ),
     'l10n' => array(
@@ -57 +55 @@
         'upload' => __( 'Upload Theme' ),
         'back'   => __( 'Back' ),
-        'error'  => sprintf( __( 'An unexpected error occurred and we can&#8127;t reach WordPress.org. If you continue to have problems, please try the <a href="%s">support forums</a>.' ), __( 'https://wordpress.org/support/' ) )
+        'error'  => __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' )
     ),
     'installedThemes' => array_keys( $installed_themes ),
@@ -200 +198 @@
 
     <div class="theme-actions">
-        <a class="button button-primary" href="{{ data.installURI }}"><?php esc_html_e( 'Install' ); ?></a>
+        <a class="button button-primary" href="{{ data.install_url }}"><?php esc_html_e( 'Install' ); ?></a>
         <a class="button button-secondary preview install-theme-preview" href="#"><?php esc_html_e( 'Preview' ); ?></a>
     </div>
@@ -216 +214 @@
             <a href="#" class="button button-primary theme-install disabled"><?php _e( 'Installed' ); ?></a>
         <# } else { #>
-            <a href="{{ data.installURI }}" class="button button-primary theme-install"><?php _e( 'Install' ); ?></a>
+            <a href="{{ data.install_url }}" class="button button-primary theme-install"><?php _e( 'Install' ); ?></a>
         <# } #>
         </div>
@@ -234 +232 @@
                         <span class="five"></span>
                     <# if ( data.num_ratings ) { #>
-                        <p class="ratings">({{ data.num_ratings }})</p>
+                        <p class="ratings">{{ data.num_ratings }}</p>
                     <# } else { #>
                         <p class="ratings"><?php _e( 'No ratings.' ); ?></p>

trunk/src/wp-admin/update.php

@@ -203 +203 @@
         include_once ABSPATH . 'wp-admin/includes/theme-install.php'; //for themes_api..
 
-        check_admin_referer( 'install-theme' );
+        check_admin_referer( 'install-theme_' . $theme );
         $api = themes_api('theme_information', array('slug' => $theme, 'fields' => array('sections' => false, 'tags' => false) ) ); //Save on a bit of bandwidth.