Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Block Theme Previews: Add a nonce for activation #4795

Closed
wants to merge 7 commits into from
Closed

Block Theme Previews: Add a nonce for activation #4795

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d01393e
Block Theme Previews: Add a nonce for activation, and ensure that we …
scruffian Jul 5, 2023
b06bdb3
fix formatting
scruffian Jul 5, 2023
2041820
update comment
scruffian Jul 5, 2023
0cdfdc9
prefix function
scruffian Jul 5, 2023
af5e72c
Change wording of doc
tellthemachines Jul 11, 2023
c8deaf4
Add WP prefix to global
tellthemachines Jul 11, 2023
e7e4ce2
Add private note
tellthemachines Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions src/wp-admin/includes/admin-filters.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,10 +168,3 @@

// Append '(Draft)' to draft page titles in the privacy page dropdown.
add_filter( 'list_pages', '_wp_privacy_settings_filter_draft_page_titles', 10, 2 );

// Attaches filters to enable theme previews in the Site Editor.
if ( ! empty( $_GET['wp_theme_preview'] ) ) {
add_filter( 'stylesheet', 'wp_get_theme_preview_path' );
add_filter( 'template', 'wp_get_theme_preview_path' );
add_action( 'init', 'wp_attach_theme_preview_middleware' );
}
1 change: 0 additions & 1 deletion src/wp-admin/includes/admin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,6 @@

/** WordPress Theme Administration API */
require_once ABSPATH . 'wp-admin/includes/theme.php';
require_once ABSPATH . 'wp-admin/includes/theme-previews.php';

/** WordPress Privacy Functions */
require_once ABSPATH . 'wp-admin/includes/privacy-tools.php';
Expand Down
24 changes: 24 additions & 0 deletions src/wp-admin/includes/theme-previews.php → src/wp-includes/theme-previews.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,3 +54,27 @@ function wp_attach_theme_preview_middleware() {
'after'
);
}

/**
* Adds a nonce for the theme activation link.
* This is needed until we have a way to activate the theme via the REST API.
* See https://github.com/WordPress/gutenberg/pull/41836.
*
* @since 6.3.0
*/
function wp_block_theme_activate_nonce() {
$nonce_handle = 'switch-theme_' . wp_get_theme_preview_path();
Copy link

@anton-vlasenko anton-vlasenko Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick: I don't see many PHP frameworks using inline tags to output text these days. Instead, I would use echo or print to output the nonce code to the buffer. But I admit, this is just a personal preference.

?>
<script type="text/javascript">
window.BLOCK_THEME_ACTIVATE_NONCE = '<?php echo wp_create_nonce( $nonce_handle ); ?>';
</script>
<?php
}

// Attaches filters to enable theme previews in the Site Editor.
if ( ! empty( $_GET['wp_theme_preview'] ) ) {
add_filter( 'stylesheet', 'wp_get_theme_preview_path' );
add_filter( 'template', 'wp_get_theme_preview_path' );
add_action( 'init', 'wp_attach_theme_preview_middleware' );
add_action( 'admin_head', 'wp_block_theme_activate_nonce' );
}
1 change: 1 addition & 0 deletions src/wp-settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,7 @@
require ABSPATH . WPINC . '/block-template-utils.php';
require ABSPATH . WPINC . '/block-template.php';
require ABSPATH . WPINC . '/theme-templates.php';
require ABSPATH . WPINC . '/theme-previews.php';
require ABSPATH . WPINC . '/template.php';
require ABSPATH . WPINC . '/https-detection.php';
require ABSPATH . WPINC . '/https-migration.php';
Expand Down