Introduce AJAX response message

[alexvorn2]

when clicking on Save button of a widget, a error should appear if the user is logged out.

So after clicking the button the wpspin animated images disappears and nothing happens. This can be a problem if the current user think he is logged in and he is not, the settings just will not be saved.

Sometimes the server is not working.

Need to adjust the javascript code and php:
in php we can use die function : die('1') or die('success');

in javascript something like this:

$.post(ajaxurl, data, function(response){
   if (response === 'success') {} else { alert('Fail to save'); } 
});

​http://wpimpact.com/wp-content/uploads/2012/05/Untitled-4.png

[kurtpayne]

Replace widget controls with "You are logged out!" message

[kurtpayne]

This needs a look by one of the UX engineers, but I think the ticket raises a valid question. WordPress alerts when a draft can't be saved because a user is logged out, shouldn't widgets follow the same pattern? 20770.patch​ replaces the controls with a "You are logged out!" message. The message needs some padding (UI, help?) but it works.

[helenyhou]

20770.diff​ adds the p tag for padding and adjusts CSS accordingly. I would imagine the messaging should match that of the similar alerts and have the link to log in again.

I like this, but I think it's weird that it replaces the controls entirely - no way to go back and save the changes if you log in in another window. Maybe worth just inserting before the controls instead.

[alexvorn2]

why if ( "0" === r ) but not ( "-1" === r ) ?

[kurtpayne]

Don't replace the controls. Adds CSS fixes.

[kurtpayne]

Replying to helenyhou:

I like this, but I think it's weird that it replaces the controls entirely - no way to go back and save the changes if you log in in another window. Maybe worth just inserting before the controls instead.

Agreed. 20770.1.patch​ integrates your padding / CSS changes with this. A new div is added for a "You are logged out." message. The message is removed if a user logs back in. If the user repeatedly clicks "Save" then the message flashes (a la fadeOut(50).fadeIn(500)). Feel free to adjust the UX accordingly.

Replying to alexvorn2:

why if ( "0" === r ) but not ( "-1" === r ) ?

The widget ajax (if successful) returns HTML code. A successful save on the meta widget, for example, may return this:

<p><label for="widget-meta-2-title">Title:</label> <input class="widefat" id="widget-meta-2-title" name="widget-meta[2][title]" type="text" value="title goes here" /></p>

If the ajax fails, it returns 0 (which javascript treats as a string in this instance).

Why does it return 0 and not -1? If you're logged in, admin-ajax.php will call do_action('wp_ajax_' . $_REQUEST['action']); otherwise, it calls do_action('wp_ajax_nopriv_' . $_REQUEST['action']);.

You might read the code and think it would call wp_ajax_save_widget() and fail on check_ajax_referer() and call wp_die(-1) and the javascript should check for -1. However, in this instance, if you're not logged in, WordPress will never call wp_ajax_save_widget(), it will simply fall all through way through admin-ajax.php and hit the last line: die(0);

[nacin]

check_ajax_referer() can fail to due a bad nonce. Nonces are only good for up to 24 hours, but a logged-in cookie is good for two days (14 if you check 'Remember Me').

On post.php, we refresh the nonce automatically if it is in the second half of its life. We don't, as far as I know, on widgets.php.

If the nonce check fails, no amount of logging in will help them, as they still don't have a valid nonce on that page. The page would need to be refreshed. So while checking for "-1" won't help, there is still the possibility of an error condition.

Due to the nature of widgets.php, we probably should be cycling the nonce in the 12 final hours of its validity.

[kurtpayne]

Reset the nonce every time widgets are saved

[kurtpayne]

Replying to nacin:

Due to the nature of widgets.php, we probably should be cycling the nonce in the 12 final hours of its validity.

Not sure if this is what you meant, but check out 20770.2.diff​. It re-sets the nonce using an HTTP header whenever widgets are saved. It's opt-in, so it can be re-used by any ajax function (like draft saving).

[helen]

I had completely forgotten that I tested that patch long ago when I was still getting rolling. Closing as a dupe of #23120, which has more recent work and a direction that fits the current admin.