Changeset 40704
- Timestamp:
- 05/16/2017 12:06:32 PM (7 years ago)
- Location:
- trunk/src
- Files:
-
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-admin/customize.php
r40510 r40704 156 156 <div class="accordion-section-title"> 157 157 <span class="preview-notice"><?php 158 echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name' ) . '</strong>' );158 echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name', 'display' ) . '</strong>' ); 159 159 ?></span> 160 160 <button type="button" class="customize-help-toggle dashicons dashicons-editor-help" aria-expanded="false"><span class="screen-reader-text"><?php _e( 'Help' ); ?></span></button> -
trunk/src/wp-admin/js/customize-controls.js
r40627 r40704 4581 4581 }); 4582 4582 4583 // Ensure preview nonce is included with every customized request, to allow post data to be read. 4584 $.ajaxPrefilter( function injectPreviewNonce( options ) { 4585 if ( ! /wp_customize=on/.test( options.data ) ) { 4586 return; 4587 } 4588 options.data += '&' + $.param({ 4589 customize_preview_nonce: api.settings.nonce.preview 4590 }); 4591 }); 4592 4583 4593 // Refresh the nonces if the preview sends updated nonces over. 4584 4594 api.previewer.bind( 'nonce', function( nonce ) { -
trunk/src/wp-includes/class-wp-customize-manager.php
r40643 r40704 485 485 if ( ! preg_match( '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/', $this->_changeset_uuid ) ) { 486 486 $this->wp_die( -1, __( 'Invalid changeset UUID' ) ); 487 } 488 489 /* 490 * Clear incoming post data if the user lacks a CSRF token (nonce). Note that the customizer 491 * application will inject the customize_preview_nonce query parameter into all Ajax requests. 492 * For similar behavior elsewhere in WordPress, see rest_cookie_check_errors() which logs out 493 * a user when a valid nonce isn't present. 494 */ 495 $has_post_data_nonce = ( 496 check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce', false ) 497 || 498 check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce', false ) 499 || 500 check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'customize_preview_nonce', false ) 501 ); 502 if ( ! current_user_can( 'customize' ) || ! $has_post_data_nonce ) { 503 unset( $_POST['customized'] ); 504 unset( $_REQUEST['customized'] ); 487 505 } 488 506
Note: See TracChangeset
for help on using the changeset viewer.