WordPress.org

Make WordPress Core

Changeset 42615


Ignore:
Timestamp:
01/30/2018 12:20:37 AM (3 years ago)
Author:
westonruter
Message:

Customize: Ensure customize_autosaved requests only use revision of logged-in user.

Props dlh, westonruter.
See #42433, #39896.
Fixes #42450.

Location:
trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/class-wp-customize-manager.php

    r42612 r42615  
    11421142            $this->_changeset_data = array();
    11431143        } else {
    1144             if ( $this->autosaved() ) {
     1144            if ( $this->autosaved() && is_user_logged_in() ) {
    11451145                $autosave_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
    11461146                if ( $autosave_post ) {
     
    29032903                $r                       = wp_update_post( wp_slash( $post_array ), true );
    29042904
    2905                 // Delete autosave revision when the changeset is updated.
    2906                 $autosave_draft = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
    2907                 if ( $autosave_draft ) {
    2908                     wp_delete_post( $autosave_draft->ID, true );
     2905                // Delete autosave revision for user when the changeset is updated.
     2906                if ( ! empty( $args['user_id'] ) ) {
     2907                    $autosave_draft = wp_get_post_autosave( $changeset_post_id, $args['user_id'] );
     2908                    if ( $autosave_draft ) {
     2909                        wp_delete_post( $autosave_draft->ID, true );
     2910                    }
    29092911                }
    29102912            }
     
    35493551     */
    35503552    public function handle_dismiss_autosave_or_lock_request() {
     3553        // Calls to dismiss_user_auto_draft_changesets() and wp_get_post_autosave() require non-zero get_current_user_id().
     3554        if ( ! is_user_logged_in() ) {
     3555            wp_send_json_error( 'unauthenticated', 401 );
     3556        }
     3557
    35513558        if ( ! $this->is_preview() ) {
    35523559            wp_send_json_error( 'not_preview', 400 );
     
    46504657        if ( ! $this->saved_starter_content_changeset && ! $this->autosaved() ) {
    46514658            if ( $changeset_post_id ) {
    4652                 $autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
     4659                if ( is_user_logged_in() ) {
     4660                    $autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
     4661                }
    46534662            } else {
    46544663                $autosave_autodraft_posts = $this->get_changeset_posts(
  • trunk/tests/phpunit/tests/ajax/CustomizeManager.php

    r42343 r42615  
    553553     */
    554554    public function test_handle_dismiss_autosave_or_lock_request() {
    555         $uuid         = wp_generate_uuid4();
    556         $wp_customize = $this->set_up_valid_state( $uuid );
     555        $uuid          = wp_generate_uuid4();
     556        $wp_customize  = $this->set_up_valid_state( $uuid );
     557        $valid_user_id = get_current_user_id();
     558
     559        // Temporarily remove user to test requirement that user is logged in. See #42450.
     560        wp_set_current_user( 0 );
     561        $this->make_ajax_call( 'customize_dismiss_autosave_or_lock' );
     562        $this->assertFalse( $this->_last_response_parsed['success'] );
     563        $this->assertEquals( 'unauthenticated', $this->_last_response_parsed['data'] );
     564        wp_set_current_user( $valid_user_id );
    557565
    558566        $this->make_ajax_call( 'customize_dismiss_autosave_or_lock' );
  • trunk/tests/phpunit/tests/customize/manager.php

    r42343 r42615  
    525525            wp_list_pluck( $wp_customize->changeset_data(), 'value' )
    526526        );
     527
     528        // If there is no user, don't fetch the most recent autosave. See #42450.
     529        wp_set_current_user( 0 );
     530        $wp_customize = new WP_Customize_Manager(
     531            array(
     532                'changeset_uuid' => $uuid,
     533                'autosaved'      => true,
     534            )
     535        );
     536        $this->assertEquals( $data, $wp_customize->changeset_data() );
    527537    }
    528538
Note: See TracChangeset for help on using the changeset viewer.