Changeset 42852 for trunk

Timestamp:

03/18/2018 05:20:47 PM (7 years ago)

Author:

ocean90

Message:

REST API JavaScript Client: Support an empty string for nonce to disable sending the X-WP-Nonce header.

Passing a nonce argument with an empty string to wp.api.init() now does no longer fall back to wpApiSettings.nonce. This makes it possible to stop sending nonce headers, for example to a read-only endpoint on another site in a multisite install.

Props adamsilverstein, FPCSJames, ocean90, swissspidy.
Fixes #42948, #43266.

File:

• trunk/src/wp-includes/js/wp-api.js (modified) (4 diffs)

trunk/src/wp-includes/js/wp-api.js

@@ -849 +849 @@
                 }
 
-                if ( _.isFunction( model.nonce ) && ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
+                if ( _.isFunction( model.nonce ) && ! _.isEmpty( model.nonce() ) ) {
                     beforeSend = options.beforeSend;
 
@@ -993 +993 @@
                 options = options || {};
 
-                if ( _.isFunction( model.nonce ) && ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
+                if ( _.isFunction( model.nonce ) && ! _.isEmpty( model.nonce() ) ) {
                     beforeSend = options.beforeSend;
 
@@ -1491 +1491 @@
      *
      * @param {object} [args]
+     * @param {string} [args.nonce] The nonce. Optional, defaults to wpApiSettings.nonce.
      * @param {string} [args.apiRoot] The api root. Optional, defaults to wpApiSettings.root.
      * @param {string} [args.versionString] The version string. Optional, defaults to wpApiSettings.root.
@@ -1499 +1500 @@
 
         args                      = args || {};
-        attributes.nonce          = args.nonce || wpApiSettings.nonce || '';
+        attributes.nonce          = _.isString( args.nonce ) ? args.nonce : ( wpApiSettings.nonce || '' );
         attributes.apiRoot        = args.apiRoot || wpApiSettings.root || '/wp-json';
         attributes.versionString  = args.versionString || wpApiSettings.versionString || 'wp/v2/';