From 69112517eda75e6758122dd8f1b2c5412fecda75 Mon Sep 17 00:00:00 2001 From: nacin Date: Tue, 26 Jun 2012 18:48:18 +0000 Subject: [PATCH] Refresh nonces in the customizer. props koopersmith. see #20876. git-svn-id: http://core.svn.wordpress.org/trunk@21135 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/customize.php | 7 ++++- wp-admin/js/customize-controls.dev.js | 33 +++++++++++++++------- wp-includes/class-wp-customize-manager.php | 13 ++++++++- wp-includes/js/customize-preview.dev.js | 7 ++++- wp-login.php | 30 +++++++++----------- 5 files changed, 60 insertions(+), 30 deletions(-) diff --git a/wp-admin/customize.php b/wp-admin/customize.php index 3e6a67508..09c5b6789 100644 --- a/wp-admin/customize.php +++ b/wp-admin/customize.php @@ -7,6 +7,8 @@ * @since 3.4.0 */ +define( 'IFRAME_REQUEST', true ); + require_once( './admin.php' ); if ( ! current_user_can( 'edit_theme_options' ) ) wp_die( __( 'Cheatin’ uh?' ) ); @@ -65,7 +67,6 @@ do_action( 'customize_controls_print_scripts' );
- get_stylesheet() ); ?>
is_theme_active() ? __( 'Save & Publish' ) : __( 'Save & Activate' ); @@ -175,6 +176,10 @@ do_action( 'customize_controls_print_scripts' ); ), 'settings' => array(), 'controls' => array(), + 'nonce' => array( + 'save' => wp_create_nonce( 'save-customize_' . $wp_customize->get_stylesheet() ), + 'preview' => wp_create_nonce( 'preview-customize_' . $wp_customize->get_stylesheet() ) + ), ); foreach ( $wp_customize->settings() as $id => $setting ) { diff --git a/wp-admin/js/customize-controls.dev.js b/wp-admin/js/customize-controls.dev.js index cb4e6e20a..c37e43bd0 100644 --- a/wp-admin/js/customize-controls.dev.js +++ b/wp-admin/js/customize-controls.dev.js @@ -294,7 +294,8 @@ // This is the promise object. deferred.promise( this ); - this.previewer = params.previewer; + this.container = params.container; + this.signature = params.signature; $.extend( params, { channel: api.PreviewFrame.uuid() }); @@ -338,7 +339,7 @@ this.request.done( function( response ) { var location = self.request.getResponseHeader('Location'), - signature = 'WP_CUSTOMIZER_SIGNATURE', + signature = self.signature, index; // Check if the location response header differs from the current URL. @@ -371,7 +372,7 @@ response = response.slice( 0, index ) + response.slice( index + signature.length ); // Create the iframe and inject the html content. - self.iframe = $('