WordPress.org

Make WordPress Core

Opened 19 months ago

Closed 19 months ago

Last modified 19 months ago

#35914 closed defect (bug) (fixed)

Prevent exporting a partial for selective refresh when user can't preview its settings

Reported by: westonruter Owned by: westonruter
Milestone: 4.5 Priority: normal
Severity: normal Version: 4.6
Component: Customize Keywords: has-patch has-unit-tests commit
Focuses: Cc:

Description

When partials get registered, they are associated with one or more settings, just as controls do. Controls are prevented from being exported to the client if they are associated with any settings that the user doesn't have the capability to update. At the moment, however, partials do not have parity with controls in this way: partials are being exported to the client even if the user cannot make any changes to them. This results in misleading “Shift-click to edit this element.” messages for such users.

So WP_Customize_Partial::check_capabilities() should be created for parity with WP_Customize_Control::check_capabilities(). Partials that don't pass the capability check can be omitted from being exported to the client. These partials can also be rejected from requests to render partials. While these are currently not rejected, they can only be previewed using settings already saved in the DB, since setting changes will be ignored if the user doesn't have the capability: these are currently treated as read-only partial renders.

Attachments (2)

35914.0.diff (2.7 KB) - added by westonruter 19 months ago.
35914.1.diff (5.5 KB) - added by westonruter 19 months ago.

Download all attachments as: .zip

Change History (9)

#1 @westonruter
19 months ago

  • Keywords has-patch needs-unit-tests added
  • Owner set to westonruter
  • Status changed from new to accepted

#2 @westonruter
19 months ago

  • Keywords has-unit-tests commit added; needs-unit-tests removed

#3 @DrewAPicture
19 months ago

@westonruter 35914.1.diff Looks good. One thing on the DocBlock for the check_capabilities() method, the return type should just be false if the return is always false.

#4 @westonruter
19 months ago

@DrewAPicture it also returns true.

#5 @DrewAPicture
19 months ago

@westonruter Yeah, let me remove my foot from my mouth.

#6 @westonruter
19 months ago

  • Resolution set to fixed
  • Status changed from accepted to closed

In 36643:

Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings.

Introduces WP_Customize_Partial::check_capabilities() for parity with WP_Customize_Control::check_capabilities().

See #27355.
Fixes #35914.

#7 @westonruter
19 months ago

In 36650:

Customize: Fix and extend broken ajax unit tests to account for partials being skipped from rendering.

Fixes regression introduced in [36643].

See #35914.

Note: See TracTickets for help on using tickets.