Changeset 42615

Timestamp:

01/30/2018 12:20:37 AM (7 years ago)

Author:

westonruter

Message:

Customize: Ensure customize_autosaved requests only use revision of logged-in user.

Props dlh, westonruter.
See #42433, #39896.
Fixes #42450.

Location:

trunk

Files:

• src/wp-includes/class-wp-customize-manager.php (modified) (4 diffs)
• tests/phpunit/tests/ajax/CustomizeManager.php (modified) (1 diff)
• tests/phpunit/tests/customize/manager.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -1142 +1142 @@
             $this->_changeset_data = array();
         } else {
-            if ( $this->autosaved() ) {
+            if ( $this->autosaved() && is_user_logged_in() ) {
                 $autosave_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
                 if ( $autosave_post ) {
@@ -2903 +2903 @@
                 $r                       = wp_update_post( wp_slash( $post_array ), true );
 
-                // Delete autosave revision when the changeset is updated.
-                $autosave_draft = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
-                if ( $autosave_draft ) {
-                    wp_delete_post( $autosave_draft->ID, true );
+                // Delete autosave revision for user when the changeset is updated.
+                if ( ! empty( $args['user_id'] ) ) {
+                    $autosave_draft = wp_get_post_autosave( $changeset_post_id, $args['user_id'] );
+                    if ( $autosave_draft ) {
+                        wp_delete_post( $autosave_draft->ID, true );
+                    }
                 }
             }
@@ -3549 +3551 @@
      */
     public function handle_dismiss_autosave_or_lock_request() {
+        // Calls to dismiss_user_auto_draft_changesets() and wp_get_post_autosave() require non-zero get_current_user_id().
+        if ( ! is_user_logged_in() ) {
+            wp_send_json_error( 'unauthenticated', 401 );
+        }
+
         if ( ! $this->is_preview() ) {
             wp_send_json_error( 'not_preview', 400 );
@@ -4650 +4657 @@
         if ( ! $this->saved_starter_content_changeset && ! $this->autosaved() ) {
             if ( $changeset_post_id ) {
-                $autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
+                if ( is_user_logged_in() ) {
+                    $autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
+                }
             } else {
                 $autosave_autodraft_posts = $this->get_changeset_posts(

trunk/tests/phpunit/tests/ajax/CustomizeManager.php

@@ -553 +553 @@
      */
     public function test_handle_dismiss_autosave_or_lock_request() {
-        $uuid         = wp_generate_uuid4();
-        $wp_customize = $this->set_up_valid_state( $uuid );
+        $uuid          = wp_generate_uuid4();
+        $wp_customize  = $this->set_up_valid_state( $uuid );
+        $valid_user_id = get_current_user_id();
+
+        // Temporarily remove user to test requirement that user is logged in. See #42450.
+        wp_set_current_user( 0 );
+        $this->make_ajax_call( 'customize_dismiss_autosave_or_lock' );
+        $this->assertFalse( $this->_last_response_parsed['success'] );
+        $this->assertEquals( 'unauthenticated', $this->_last_response_parsed['data'] );
+        wp_set_current_user( $valid_user_id );
 
         $this->make_ajax_call( 'customize_dismiss_autosave_or_lock' );

trunk/tests/phpunit/tests/customize/manager.php

@@ -525 +525 @@
             wp_list_pluck( $wp_customize->changeset_data(), 'value' )
         );
+
+        // If there is no user, don't fetch the most recent autosave. See #42450.
+        wp_set_current_user( 0 );
+        $wp_customize = new WP_Customize_Manager(
+            array(
+                'changeset_uuid' => $uuid,
+                'autosaved'      => true,
+            )
+        );
+        $this->assertEquals( $data, $wp_customize->changeset_data() );
     }