Changeset 40705

Timestamp:

05/16/2017 12:13:07 PM (9 years ago)

Author:

ocean90

Message:

Customize: Ignore invalid customization sessions.

Merge of [40704] to the 4.7 branch.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/customize.php (modified) (1 diff)
• src/wp-admin/js/customize-controls.js (modified) (1 diff)
• src/wp-includes/class-wp-customize-manager.php (modified) (1 diff)

branches/4.7/src/wp-admin/customize.php

@@ -156 +156 @@
                                 <div class="accordion-section-title">
                                         <span class="preview-notice"><?php
-                                                echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name' ) . '</strong>' );
+                                                echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name', 'display' ) . '</strong>' );
                                         ?></span>
                                         <button type="button" class="customize-help-toggle dashicons dashicons-editor-help" aria-expanded="false"><span class="screen-reader-text"><?php _e( 'Help' ); ?></span></button>

branches/4.7/src/wp-admin/js/customize-controls.js

@@ -4580 +4580 @@
                 });
 
+                // Ensure preview nonce is included with every customized request, to allow post data to be read.
+                $.ajaxPrefilter( function injectPreviewNonce( options ) {
+                        if ( ! /wp_customize=on/.test( options.data ) ) {
+                                return;
+                        }
+                        options.data += '&' + $.param({
+                                customize_preview_nonce: api.settings.nonce.preview
+                        });
+                });
+
                 // Refresh the nonces if the preview sends updated nonces over.
                 api.previewer.bind( 'nonce', function( nonce ) {

branches/4.7/src/wp-includes/class-wp-customize-manager.php

@@ -483 +483 @@
                 if ( ! preg_match( '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/', $this->_changeset_uuid ) ) {
                         $this->wp_die( -1, __( 'Invalid changeset UUID' ) );
+                }
+
+                /*
+                 * Clear incoming post data if the user lacks a CSRF token (nonce). Note that the customizer
+                 * application will inject the customize_preview_nonce query parameter into all Ajax requests.
+                 * For similar behavior elsewhere in WordPress, see rest_cookie_check_errors() which logs out
+                 * a user when a valid nonce isn't present.
+                 */
+                $has_post_data_nonce = (
+                        check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce', false )
+                        ||
+                        check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce', false )
+                        ||
+                        check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'customize_preview_nonce', false )
+                );
+                if ( ! current_user_can( 'customize' ) || ! $has_post_data_nonce ) {
+                        unset( $_POST['customized'] );
+                        unset( $_REQUEST['customized'] );
                 }