Index: trunk/src/wp-includes/theme.php
===================================================================
--- trunk/src/wp-includes/theme.php	(revision 38649)
+++ trunk/src/wp-includes/theme.php	(revision 38810)
@@ -2067,7 +2067,7 @@
  *
  * Loads the Customizer at plugins_loaded when accessing the customize.php admin
- * page or when any request includes a wp_customize=on param, either as a GET
- * query var or as POST data. This param is a signal for whether to bootstrap
- * the Customizer when WordPress is loading, especially in the Customizer preview
+ * page or when any request includes a wp_customize=on param or a customize_changeset
+ * param (a UUID). This param is a signal for whether to bootstrap the Customizer when
+ * WordPress is loading, especially in the Customizer preview
  * or when making Customizer Ajax requests for widgets or menus.
  *
@@ -2077,12 +2077,138 @@
  */
 function _wp_customize_include() {
-	if ( ! ( ( isset( $_REQUEST['wp_customize'] ) && 'on' == $_REQUEST['wp_customize'] )
-		|| ( is_admin() && 'customize.php' == basename( $_SERVER['PHP_SELF'] ) )
-	) ) {
+
+	$is_customize_admin_page = ( is_admin() && 'customize.php' == basename( $_SERVER['PHP_SELF'] ) );
+	$should_include = (
+		$is_customize_admin_page
+		||
+		( isset( $_REQUEST['wp_customize'] ) && 'on' == $_REQUEST['wp_customize'] )
+		||
+		( ! empty( $_GET['customize_changeset_uuid'] ) || ! empty( $_POST['customize_changeset_uuid'] ) )
+	);
+
+	if ( ! $should_include ) {
 		return;
 	}
 
-	require_once ABSPATH . WPINC . '/class-wp-customize-manager.php'; 
-	$GLOBALS['wp_customize'] = new WP_Customize_Manager();
+	/*
+	 * Note that wp_unslash() is not being used on the input vars because it is
+	 * called before wp_magic_quotes() gets called. Besides this fact, none of
+	 * the values should contain any characters needing slashes anyway.
+	 */
+	$keys = array( 'changeset_uuid', 'customize_changeset_uuid', 'customize_theme', 'theme', 'customize_messenger_channel' );
+	$input_vars = array_merge(
+		wp_array_slice_assoc( $_GET, $keys ),
+		wp_array_slice_assoc( $_POST, $keys )
+	);
+
+	$theme = null;
+	$changeset_uuid = null;
+	$messenger_channel = null;
+
+	if ( $is_customize_admin_page && isset( $input_vars['changeset_uuid'] ) ) {
+		$changeset_uuid = sanitize_key( $input_vars['changeset_uuid'] );
+	} elseif ( ! empty( $input_vars['customize_changeset_uuid'] ) ) {
+		$changeset_uuid = sanitize_key( $input_vars['customize_changeset_uuid'] );
+	}
+
+	// Note that theme will be sanitized via WP_Theme.
+	if ( $is_customize_admin_page && isset( $input_vars['theme'] ) ) {
+		$theme = $input_vars['theme'];
+	} elseif ( isset( $input_vars['customize_theme'] ) ) {
+		$theme = $input_vars['customize_theme'];
+	}
+	if ( isset( $input_vars['customize_messenger_channel'] ) ) {
+		$messenger_channel = sanitize_key( $input_vars['customize_messenger_channel'] );
+	}
+
+	require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+	$GLOBALS['wp_customize'] = new WP_Customize_Manager( compact( 'changeset_uuid', 'theme', 'messenger_channel' ) );
+}
+
+/**
+ * Publish a snapshot's changes.
+ *
+ * @param string  $new_status     New post status.
+ * @param string  $old_status     Old post status.
+ * @param WP_Post $changeset_post Changeset post object.
+ */
+function _wp_customize_publish_changeset( $new_status, $old_status, $changeset_post ) {
+	global $wp_customize;
+
+	$is_publishing_changeset = (
+		'customize_changeset' === $changeset_post->post_type
+		&&
+		'publish' === $new_status
+		&&
+		'publish' !== $old_status
+	);
+	if ( ! $is_publishing_changeset ) {
+		return;
+	}
+
+	if ( empty( $wp_customize ) ) {
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+		$wp_customize = new WP_Customize_Manager( $changeset_post->post_name );
+	}
+
+	if ( ! did_action( 'customize_register' ) ) {
+		/*
+		 * When running from CLI or Cron, the customize_register action will need
+		 * to be triggered in order for core, themes, and plugins to register their
+		 * settings. Normally core will add_action( 'customize_register' ) at
+		 * priority 10 to register the core settings, and if any themes/plugins
+		 * also add_action( 'customize_register' ) at the same priority, they
+		 * will have a $wp_customize with those settings registered since they
+		 * call add_action() afterward, normally. However, when manually doing
+		 * the customize_register action after the setup_theme, then the order
+		 * will be reversed for two actions added at priority 10, resulting in
+		 * the core settings no longer being available as expected to themes/plugins.
+		 * So the following manually calls the method that registers the core
+		 * settings up front before doing the action.
+		 */
+		remove_action( 'customize_register', array( $wp_customize, 'register_controls' ) );
+		$wp_customize->register_controls();
+
+		/** This filter is documented in /wp-includes/class-wp-customize-manager.php */
+		do_action( 'customize_register', $wp_customize );
+	}
+	$wp_customize->_publish_changeset_values( $changeset_post->ID ) ;
+
+	/*
+	 * Trash the changeset post if revisions are not enabled. Unpublished
+	 * changesets by default get garbage collected due to the auto-draft status.
+	 * When a changeset post is published, however, it would no longer get cleaned
+	 * out. Ths is a problem when the changeset posts are never displayed anywhere,
+	 * since they would just be endlessly piling up. So here we use the revisions
+	 * feature to indicate whether or not a published changeset should get trashed
+	 * and thus garbage collected.
+	 */
+	if ( ! wp_revisions_enabled( $changeset_post ) ) {
+		wp_trash_post( $changeset_post->ID );
+	}
+}
+
+/**
+ * Filters changeset post data upon insert to ensure post_name is intact.
+ *
+ * This is needed to prevent the post_name from being dropped when the post is
+ * transitioned into pending status by a contributor.
+ *
+ * @since 4.7.0
+ * @see wp_insert_post()
+ *
+ * @param array $post_data          An array of slashed post data.
+ * @param array $supplied_post_data An array of sanitized, but otherwise unmodified post data.
+ * @returns array Filtered data.
+ */
+function _wp_customize_changeset_filter_insert_post_data( $post_data, $supplied_post_data ) {
+	if ( isset( $post_data['post_type'] ) && 'customize_changeset' === $post_data['post_type'] ) {
+
+		// Prevent post_name from being dropped, such as when contributor saves a changeset post as pending.
+		if ( empty( $post_data['post_name'] ) && ! empty( $supplied_post_data['post_name'] ) ) {
+			$post_data['post_name'] = $supplied_post_data['post_name'];
+		}
+	}
+	return $post_data;
 }
 
