<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[24528] trunk: Nonce refresh:</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://core.trac.wordpress.org/changeset/24528">24528</a></dd>
<dt>Author</dt> <dd>azaozz</dd>
<dt>Date</dt> <dd>2013-06-29 01:31:44 +0000 (Sat, 29 Jun 2013)</dd>
</dl>
<h3>Log Message</h3>
<pre>Nonce refresh:
- Update the heartbeat nonce when refreshing nonces on the Edit Post screen.
- After a user logs in from the auth-check dialog, speed up heatrbeat to check/refresh nonces on the Edit Post screen.
- Speeding up heartbeat: bring back the setting how long it should last (how many ticks).
- Add 'heartbeat-nonces-expired' jQuery event when nonces have expired and the user is logged in.
See <a href="http://core.trac.wordpress.org/ticket/23295">#23295</a>, see <a href="http://core.trac.wordpress.org/ticket/23216">#23216</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkwpadminincludesajaxactionsphp">trunk/wp-admin/includes/ajax-actions.php</a></li>
<li><a href="#trunkwpadminincludesmiscphp">trunk/wp-admin/includes/misc.php</a></li>
<li><a href="#trunkwpadminjspostjs">trunk/wp-admin/js/post.js</a></li>
<li><a href="#trunkwpincludesjsheartbeatjs">trunk/wp-includes/js/heartbeat.js</a></li>
<li><a href="#trunkwpincludesjswpauthcheckjs">trunk/wp-includes/js/wp-auth-check.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkwpadminincludesajaxactionsphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/includes/ajax-actions.php (24527 => 24528)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/includes/ajax-actions.php 2013-06-27 21:59:48 UTC (rev 24527)
+++ trunk/wp-admin/includes/ajax-actions.php 2013-06-29 01:31:44 UTC (rev 24528)
</span><span class="lines">@@ -2054,9 +2054,17 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> function wp_ajax_heartbeat() {
</span><del>- check_ajax_referer( 'heartbeat-nonce', '_nonce' );
</del><ins>+ if ( empty( $_POST['_nonce'] ) )
+ wp_send_json_error();
+
</ins><span class="cx"> $response = array();
</span><span class="cx">
</span><ins>+ if ( false === wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' ) ) {
+ // User is logged in but nonces have expired.
+ $response['nonces_expired'] = true;
+ wp_send_json($response);
+ }
+
</ins><span class="cx"> // screen_id is the same as $current_screen->id and the JS global 'pagenow'
</span><span class="cx"> if ( ! empty($_POST['screen_id']) )
</span><span class="cx"> $screen_id = sanitize_key($_POST['screen_id']);
</span><span class="lines">@@ -2076,7 +2084,7 @@
</span><span class="cx"> // Allow the transport to be replaced with long-polling easily
</span><span class="cx"> do_action( 'heartbeat_tick', $response, $screen_id );
</span><span class="cx">
</span><del>- // send the current time acording to the server
</del><ins>+ // Send the current time acording to the server
</ins><span class="cx"> $response['server_time'] = time();
</span><span class="cx">
</span><span class="cx"> wp_send_json($response);
</span></span></pre></div>
<a id="trunkwpadminincludesmiscphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/includes/misc.php (24527 => 24528)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/includes/misc.php 2013-06-27 21:59:48 UTC (rev 24527)
+++ trunk/wp-admin/includes/misc.php 2013-06-29 01:31:44 UTC (rev 24528)
</span><span class="lines">@@ -639,21 +639,25 @@
</span><span class="cx"> function wp_refresh_post_nonces( $response, $data, $screen_id ) {
</span><span class="cx"> if ( array_key_exists( 'wp-refresh-post-nonces', $data ) ) {
</span><span class="cx"> $received = $data['wp-refresh-post-nonces'];
</span><ins>+ $response['wp-refresh-post-nonces'] = array( 'check' => 1 );
</ins><span class="cx">
</span><span class="cx"> if ( ! $post_id = absint( $received['post_id'] ) )
</span><span class="cx"> return $response;
</span><span class="cx">
</span><del>- if ( ! current_user_can('edit_post', $post_id) )
</del><ins>+ if ( ! current_user_can( 'edit_post', $post_id ) || empty( $received['post_nonce'] ) )
</ins><span class="cx"> return $response;
</span><span class="cx">
</span><del>- if ( ! empty( $received['post_nonce'] ) && 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
</del><ins>+ if ( 2 === wp_verify_nonce( $received['post_nonce'], 'update-post_' . $post_id ) ) {
</ins><span class="cx"> $response['wp-refresh-post-nonces'] = array(
</span><del>- 'replace-autosavenonce' => wp_create_nonce('autosave'),
- 'replace-getpermalinknonce' => wp_create_nonce('getpermalink'),
- 'replace-samplepermalinknonce' => wp_create_nonce('samplepermalink'),
- 'replace-closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
- 'replace-_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
- 'replace-_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
</del><ins>+ 'replace' => array(
+ 'autosavenonce' => wp_create_nonce('autosave'),
+ 'getpermalinknonce' => wp_create_nonce('getpermalink'),
+ 'samplepermalinknonce' => wp_create_nonce('samplepermalink'),
+ 'closedpostboxesnonce' => wp_create_nonce('closedpostboxes'),
+ '_ajax_linking_nonce' => wp_create_nonce( 'internal-linking' ),
+ '_wpnonce' => wp_create_nonce( 'update-post_' . $post_id ),
+ ),
+ 'heartbeatNonce' => wp_create_nonce( 'heartbeat-nonce' ),
</ins><span class="cx"> );
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkwpadminjspostjs"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/js/post.js (24527 => 24528)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/js/post.js 2013-06-27 21:59:48 UTC (rev 24527)
+++ trunk/wp-admin/js/post.js 2013-06-29 01:31:44 UTC (rev 24528)
</span><span class="lines">@@ -316,7 +316,7 @@
</span><span class="cx"> function schedule() {
</span><span class="cx"> check = false;
</span><span class="cx"> window.clearTimeout( timeout );
</span><del>- timeout = window.setTimeout( function(){ check = 1; }, 3600000 );
</del><ins>+ timeout = window.setTimeout( function(){ check = true; }, 300000 );
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> $(document).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
</span><span class="lines">@@ -329,17 +329,21 @@
</span><span class="cx"> post_nonce: nonce
</span><span class="cx"> };
</span><span class="cx"> }
</span><del>- check = 2;
</del><span class="cx"> }
</span><span class="cx"> }).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
</span><del>- if ( check === 2 )
</del><ins>+ var nonces = data['wp-refresh-post-nonces'];
+
+ if ( nonces ) {
</ins><span class="cx"> schedule();
</span><span class="cx">
</span><del>- if ( data['wp-refresh-post-nonces'] ) {
- $.each( data['wp-refresh-post-nonces'], function( selector, value ) {
- if ( selector.match(/^replace-/) )
- $( '#' + selector.replace('replace-', '') ).val( value );
- });
</del><ins>+ if ( nonces.replace ) {
+ $.each( nonces.replace, function( selector, value ) {
+ $( '#' + selector ).val( value );
+ });
+ }
+
+ if ( nonces.heartbeatNonce )
+ window.heartbeatSettings.nonce = nonces.heartbeatNonce;
</ins><span class="cx"> }
</span><span class="cx"> }).ready( function() {
</span><span class="cx"> schedule();
</span></span></pre></div>
<a id="trunkwpincludesjsheartbeatjs"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/js/heartbeat.js (24527 => 24528)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/js/heartbeat.js 2013-06-27 21:59:48 UTC (rev 24527)
+++ trunk/wp-includes/js/heartbeat.js 2013-06-29 01:31:44 UTC (rev 24528)
</span><span class="lines">@@ -10,7 +10,6 @@
</span><span class="cx"> var self = this,
</span><span class="cx"> running,
</span><span class="cx"> beat,
</span><del>- nonce,
</del><span class="cx"> screenId = typeof pagenow != 'undefined' ? pagenow : '',
</span><span class="cx"> url = typeof ajaxurl != 'undefined' ? ajaxurl : '',
</span><span class="cx"> settings,
</span><span class="lines">@@ -30,15 +29,13 @@
</span><span class="cx"> this.autostart = true;
</span><span class="cx"> this.connectionLost = false;
</span><span class="cx">
</span><del>- if ( typeof( window.heartbeatSettings ) != 'undefined' ) {
- settings = window.heartbeatSettings;
</del><ins>+ if ( typeof( window.heartbeatSettings ) == 'object' ) {
+ settings = $.extend( {}, window.heartbeatSettings );
</ins><span class="cx">
</span><span class="cx"> // Add private vars
</span><del>- nonce = settings.nonce || '';
- delete settings.nonce;
-
</del><span class="cx"> url = settings.ajaxurl || url;
</span><span class="cx"> delete settings.ajaxurl;
</span><ins>+ delete settings.nonce;
</ins><span class="cx">
</span><span class="cx"> interval = settings.interval || 15; // default interval
</span><span class="cx"> delete settings.interval;
</span><span class="lines">@@ -120,7 +117,8 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> function connect() {
</span><del>- var send = {}, data, i, empty = true;
</del><ins>+ var send = {}, data, i, empty = true,
+ nonce = typeof window.heartbeatSettings == 'object' ? window.heartbeatSettings.nonce : '';
</ins><span class="cx"> tick = time();
</span><span class="cx">
</span><span class="cx"> data = $.extend( {}, queue );
</span><span class="lines">@@ -168,6 +166,11 @@
</span><span class="cx"> if ( self.connectionLost )
</span><span class="cx"> errorstate();
</span><span class="cx">
</span><ins>+ if ( response.nonces_expired ) {
+ $(document).trigger( 'heartbeat-nonces-expired' );
+ return;
+ }
+
</ins><span class="cx"> // Change the interval from PHP
</span><span class="cx"> if ( response.heartbeat_interval ) {
</span><span class="cx"> new_interval = response.heartbeat_interval;
</span><span class="lines">@@ -334,16 +337,19 @@
</span><span class="cx"> * If the window doesn't have focus, the interval slows down to 2 min.
</span><span class="cx"> *
</span><span class="cx"> * @param string speed Interval speed: 'fast' (5sec), 'standard' (15sec) default, 'slow' (60sec)
</span><ins>+ * @param string ticks Used with speed = 'fast', how many ticks before the speed reverts back
</ins><span class="cx"> * @return int Current interval in seconds
</span><span class="cx"> */
</span><del>- this.interval = function( speed ) {
</del><ins>+ this.interval = function( speed, ticks ) {
</ins><span class="cx"> var reset, seconds;
</span><ins>+ ticks = parseInt( ticks, 10 ) || 30;
+ ticks = ticks < 1 || ticks > 30 ? 30 : ticks;
</ins><span class="cx">
</span><span class="cx"> if ( speed ) {
</span><span class="cx"> switch ( speed ) {
</span><span class="cx"> case 'fast':
</span><span class="cx"> seconds = 5;
</span><del>- countdown = 30;
</del><ins>+ countdown = ticks;
</ins><span class="cx"> break;
</span><span class="cx"> case 'slow':
</span><span class="cx"> seconds = 60;
</span></span></pre></div>
<a id="trunkwpincludesjswpauthcheckjs"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/js/wp-auth-check.js (24527 => 24528)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/js/wp-auth-check.js 2013-06-27 21:59:48 UTC (rev 24527)
+++ trunk/wp-includes/js/wp-auth-check.js 2013-06-29 01:31:44 UTC (rev 24528)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> // Interim login dialog
</span><span class="cx"> (function($){
</span><del>- var wrap, check, timeout;
</del><ins>+ var wrap, check, scheduleTimeout, hideTimeout;
</ins><span class="cx">
</span><span class="cx"> function show() {
</span><span class="cx"> var parent = $('#wp-auth-check'), form = $('#wp-auth-check-form'), noframe = wrap.find('.wp-auth-fallback-expired'), frame, loaded = false;
</span><span class="lines">@@ -32,7 +32,7 @@
</span><span class="cx"> height += 35;
</span><span class="cx"> parent.find('.wp-auth-check-close').show();
</span><span class="cx"> wrap.data('logged-in', 1);
</span><del>- setTimeout( function() { hide(); }, 3000 );
</del><ins>+ hideTimeout = setTimeout( function() { hide(); }, 3000 );
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> parent.css( 'max-height', height + 60 + 'px' );
</span><span class="lines">@@ -62,7 +62,15 @@
</span><span class="cx">
</span><span class="cx"> function hide() {
</span><span class="cx"> $(window).off( 'beforeunload.wp-auth-check' );
</span><ins>+ window.clearTimeout( hideTimeout );
</ins><span class="cx">
</span><ins>+ // When on the Edit Post screen, speed up heartbeat after the user logs in to quickly refresh nonces
+ if ( typeof adminpage != 'undefined' && ( adminpage == 'post-php' || adminpage == 'post-new-php' )
+ && typeof wp != 'undefined' && wp.heartbeat ) {
+
+ wp.heartbeat.interval( 'fast', 1 );
+ }
+
</ins><span class="cx"> wrap.fadeOut( 200, function() {
</span><span class="cx"> wrap.addClass('hidden').css('display', '').find('.wp-auth-check-close').css('display', '');
</span><span class="cx"> $('#wp-auth-check-frame').remove();
</span><span class="lines">@@ -71,8 +79,8 @@
</span><span class="cx">
</span><span class="cx"> function schedule() {
</span><span class="cx"> check = false;
</span><del>- window.clearTimeout( timeout );
- timeout = window.setTimeout( function(){ check = 1; }, 180000 ); // 3 min.
</del><ins>+ window.clearTimeout( scheduleTimeout );
+ scheduleTimeout = window.setTimeout( function(){ check = 1; }, 300000 ); // 5 min.
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> $( document ).on( 'heartbeat-tick.wp-auth-check', function( e, data ) {
</span></span></pre>
</div>
</div>
</body>
</html>