Changeset 40704 for trunk/src/wp-includes/class-wp-customize-manager.php

Timestamp:

05/16/2017 12:06:32 PM (8 years ago)

Author:

ocean90

Message:

Customize: Igore invalid customization sessions.

File:

• trunk/src/wp-includes/class-wp-customize-manager.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -485 +485 @@
         if ( ! preg_match( '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/', $this->_changeset_uuid ) ) {
             $this->wp_die( -1, __( 'Invalid changeset UUID' ) );
+        }
+
+        /*
+         * Clear incoming post data if the user lacks a CSRF token (nonce). Note that the customizer
+         * application will inject the customize_preview_nonce query parameter into all Ajax requests.
+         * For similar behavior elsewhere in WordPress, see rest_cookie_check_errors() which logs out
+         * a user when a valid nonce isn't present.
+         */
+        $has_post_data_nonce = (
+            check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce', false )
+            ||
+            check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce', false )
+            ||
+            check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'customize_preview_nonce', false )
+        );
+        if ( ! current_user_can( 'customize' ) || ! $has_post_data_nonce ) {
+            unset( $_POST['customized'] );
+            unset( $_REQUEST['customized'] );
         }