mirror of
https://github.com/WordPress/WordPress.git
synced 2024-11-08 20:01:12 +01:00
fd1dfbc113
Add `wp_json_encode()` as an escaping function when setting the `WP_BLOCK_THEME_ACTIVATE_NONCE` global on the block theme preview screen. This account for custom nonce implementations making use of special characters that require escaping in JavaScript strings. Props antonvlasenko, ramonopoly. Fixes #58712. Built from https://develop.svn.wordpress.org/trunk@56218 git-svn-id: http://core.svn.wordpress.org/trunk@55730 1a063a9b-81f0-0310-95a4-ce76da25c4cd
85 lines
2.5 KiB
PHP
85 lines
2.5 KiB
PHP
<?php
|
|
/**
|
|
* Theme previews using the Site Editor for block themes.
|
|
*
|
|
* @package WordPress
|
|
*/
|
|
|
|
/**
|
|
* Filters the blog option to return the path for the previewed theme.
|
|
*
|
|
* @since 6.3.0
|
|
*
|
|
* @param string $current_stylesheet The current theme's stylesheet or template path.
|
|
* @return string The previewed theme's stylesheet or template path.
|
|
*/
|
|
function wp_get_theme_preview_path( $current_stylesheet = null ) {
|
|
if ( ! current_user_can( 'switch_themes' ) ) {
|
|
return $current_stylesheet;
|
|
}
|
|
|
|
$preview_stylesheet = ! empty( $_GET['wp_theme_preview'] ) ? sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ) : null;
|
|
$wp_theme = wp_get_theme( $preview_stylesheet );
|
|
if ( ! is_wp_error( $wp_theme->errors() ) ) {
|
|
if ( current_filter() === 'template' ) {
|
|
$theme_path = $wp_theme->get_template();
|
|
} else {
|
|
$theme_path = $wp_theme->get_stylesheet();
|
|
}
|
|
|
|
return sanitize_text_field( $theme_path );
|
|
}
|
|
|
|
return $current_stylesheet;
|
|
}
|
|
|
|
/**
|
|
* Adds a middleware to `apiFetch` to set the theme for the preview.
|
|
* This adds a `wp_theme_preview` URL parameter to API requests from the Site Editor, so they also respond as if the theme is set to the value of the parameter.
|
|
*
|
|
* @since 6.3.0
|
|
*/
|
|
function wp_attach_theme_preview_middleware() {
|
|
// Don't allow non-admins to preview themes.
|
|
if ( ! current_user_can( 'switch_themes' ) ) {
|
|
return;
|
|
}
|
|
|
|
wp_add_inline_script(
|
|
'wp-api-fetch',
|
|
sprintf(
|
|
'wp.apiFetch.use( wp.apiFetch.createThemePreviewMiddleware( %s ) );',
|
|
wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ) )
|
|
),
|
|
'after'
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Set a JavaScript constant for theme activation.
|
|
*
|
|
* Sets the JavaScript global WP_BLOCK_THEME_ACTIVATE_NONCE containing the nonce
|
|
* required to activate a theme. For use within the site editor.
|
|
*
|
|
* @see https://github.com/WordPress/gutenberg/pull/41836.
|
|
*
|
|
* @since 6.3.0
|
|
* @private
|
|
*/
|
|
function wp_block_theme_activate_nonce() {
|
|
$nonce_handle = 'switch-theme_' . wp_get_theme_preview_path();
|
|
?>
|
|
<script type="text/javascript">
|
|
window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ) ); ?>;
|
|
</script>
|
|
<?php
|
|
}
|
|
|
|
// Attaches filters to enable theme previews in the Site Editor.
|
|
if ( ! empty( $_GET['wp_theme_preview'] ) ) {
|
|
add_filter( 'stylesheet', 'wp_get_theme_preview_path' );
|
|
add_filter( 'template', 'wp_get_theme_preview_path' );
|
|
add_action( 'init', 'wp_attach_theme_preview_middleware' );
|
|
add_action( 'admin_head', 'wp_block_theme_activate_nonce' );
|
|
}
|