Changeset 32054

Timestamp:

04/06/2015 03:09:21 PM (10 years ago)

Author:

ocean90

Message:

Customizer: Refresh nonces when a session expires and the user logs in again.

This was broken since 4.0 and the introduction of user session tokens. The nonces are now tied to session tokens as opposed to user IDs, and thus they change with each re-login.
Custom nonces can be added through the customize_refresh_nonces filter. On a successful refresh request the JavaScript API will trigger a nonce-refresh event. See widget's update nonce as an example.

props westonruter for initial patch.
fixes #31294.

Location:

trunk/src

Files:

• wp-admin/js/customize-controls.js (modified) (3 diffs)
• wp-admin/js/customize-widgets.js (modified) (1 diff)
• wp-includes/class-wp-customize-manager.php (modified) (3 diffs)
• wp-includes/class-wp-customize-widgets.php (modified) (2 diffs)

trunk/src/wp-admin/js/customize-controls.js

@@ -2359 +2359 @@
             messenger.targetWindow( iframe[0].contentWindow );
 
-            messenger.bind( 'login', function() {
-                iframe.remove();
-                messenger.destroy();
-                delete previewer._login;
-                deferred.resolve();
+            messenger.bind( 'login', function () {
+                var refreshNonces = previewer.refreshNonces();
+
+                refreshNonces.always( function() {
+                    iframe.remove();
+                    messenger.destroy();
+                    delete previewer._login;
+                });
+
+                refreshNonces.done( function() {
+                    deferred.resolve();
+                });
+
+                refreshNonces.fail( function() {
+                    previewer.cheatin();
+                    deferred.reject();
+                });
             });
 
@@ -2371 +2383 @@
         cheatin: function() {
             $( document.body ).empty().addClass('cheatin').append( '<p>' + api.l10n.cheatin + '</p>' );
+        },
+
+        refreshNonces: function() {
+            var request, deferred = $.Deferred();
+
+            deferred.promise();
+
+            request = wp.ajax.post( 'customize_refresh_nonces', {
+                wp_customize: 'on',
+                theme: api.settings.theme.stylesheet
+            });
+
+            request.done( function( response ) {
+                api.trigger( 'nonce-refresh', response );
+                deferred.resolve();
+            });
+
+            request.fail( function() {
+                deferred.reject();
+            });
+
+            return deferred;
         }
     });
@@ -2539 +2573 @@
         });
 
+        // Refresh the nonces if login sends updated nonces over.
+        api.bind( 'nonce-refresh', function( nonce ) {
+            $.extend( api.settings.nonce, nonce );
+            $.extend( api.previewer.nonce, nonce );
+        });
+
         // Create Settings
         $.each( api.settings.settings, function( id, data ) {

trunk/src/wp-admin/js/customize-widgets.js

@@ -1899 +1899 @@
     });
 
+    // Refresh the nonce if login sends updated nonces over.
+    api.bind( 'nonce-refresh', function( nonces ) {
+        api.Widgets.data.nonce = nonces['update-widget'];
+    });
+
     /**
      * Init Customizer for widgets.

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -92 +92 @@
         add_filter( 'wp_die_handler', array( $this, 'wp_die_handler' ) );
 
-        add_action( 'setup_theme',  array( $this, 'setup_theme' ) );
-        add_action( 'wp_loaded',    array( $this, 'wp_loaded' ) );
+        add_action( 'setup_theme', array( $this, 'setup_theme' ) );
+        add_action( 'wp_loaded',   array( $this, 'wp_loaded' ) );
 
         // Run wp_redirect_status late to make sure we override the status last.
@@ -106 +106 @@
         remove_action( 'admin_init', '_maybe_update_themes' );
 
-        add_action( 'wp_ajax_customize_save', array( $this, 'save' ) );
+        add_action( 'wp_ajax_customize_save',           array( $this, 'save' ) );
+        add_action( 'wp_ajax_customize_refresh_nonces', array( $this, 'refresh_nonces' ) );
 
         add_action( 'customize_register',                 array( $this, 'register_controls' ) );
@@ -782 +783 @@
         $response = apply_filters( 'customize_save_response', array(), $this );
         wp_send_json_success( $response );
+    }
+
+    /**
+     * Refresh nonces for the current preview.
+     *
+     * @since 4.2.0
+     */
+    public function refresh_nonces() {
+        if ( ! $this->is_preview() ) {
+            wp_send_json_error( 'not_preview' );
+        }
+
+        $nonces = array(
+            'save'    => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
+            'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() ),
+        );
+
+        /**
+         * Filter nonces for a customize_refresh_nonces AJAX request.
+         *
+         * @since 4.2.0
+         *
+         * @param array                $nonces Array of refreshed nonces for save and
+         *                                     preview actions.
+         * @param WP_Customize_Manager $this   WP_Customize_Manager instance.
+         */
+        $nonces = apply_filters( 'customize_refresh_nonces', $nonces, $this );
+        wp_send_json_success( $nonces );
     }
 

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -96 +96 @@
         add_action( 'customize_controls_print_footer_scripts', array( $this, 'output_widget_control_templates' ) );
         add_action( 'customize_preview_init',                  array( $this, 'customize_preview_init' ) );
+        add_filter( 'customize_refresh_nonces',                array( $this, 'refresh_nonces' ) );
 
         add_action( 'dynamic_sidebar',                         array( $this, 'tally_rendered_widgets' ) );
@@ -890 +891 @@
 
     /**
+     * Refresh nonce for widget updates.
+     *
+     * @since 4.2.0
+     * @access public
+     *
+     * @param  array $nonces Array of nonces.
+     * @return array $nonces Array of nonces.
+     */
+    public function refresh_nonces( $nonces ) {
+        $nonces['update-widget'] = wp_create_nonce( 'update-widget' );
+        return $nonces;
+    }
+
+    /**
      * When previewing, make sure the proper previewing widgets are used.
      *