Nonce failure when installing theme via FTP filesystem method

[ocean90]

Original report: ​http://wordpress.org/support/topic/theme-install-fails-in-39rc1

To force FTP you can use

add_filter( 'filesystem_method', function( $method ) {
	return 'ftpext';
} );

Steps to reproduce:

1. Go to wp-admin/theme-install.php
2. Select a theme and install
3. Enter FTP credentials (wp-admin/update.php?action=install-theme&theme=itek&_wpnonce=3cbbfc5a2d)
4. Click "Proceed"
5. Failure. (wp-admin/update.php?action=install-theme&theme=itek&_wpnonce=d1c34b4560)

Uploading via a ZIP works.

[ocean90]

27798.patch​ would fix this, but there are many other places where a theme specific nonce is currently used. I think we should revert to theme specific nonce again, if possible. Opinions?

[ocean90]

if possible

It's not quite possible for the JSONP requests.

[ocean90]

27798.2.patch​ routes search through admin-ajax and uses themes_api().

• Based on WP_Theme_Install_List_Table::install_theme_info()
• Reverts [27961] for JSONP
• Reverts parts of [27940] for num_ratings
• Suppresses trigger_error() in themes_api() when DOING_AJAX
• Fixes backToFilters which adds an anchor to URL

$theme->update_url can maybe ignored because unused

[ocean90]

27798.5.patch​ reverts parts of r28123. Themes API now supports theme=slug which will return the theme in $api->themes, so $api->info is available too.

[nacin]

In 28126:

Theme Installer: Revert to proxying through PHP for WordPress.org API requests.

This is to ensure we have valid installation nonces, though we've run into this as a problem previously (see #27639, #27581, #27055).

A tad slower, but we gained speed in 3.9 by simplifying the request made to the API.

props ocean90.
fixes #27798.