<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[28126] trunk/src/wp-admin: Theme Installer: Revert to proxying through PHP for WordPress.org API requests.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://core.trac.wordpress.org/changeset/28126">28126</a></dd>
<dt>Author</dt> <dd>nacin</dd>
<dt>Date</dt> <dd>2014-04-15 01:15:43 +0000 (Tue, 15 Apr 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Theme Installer: Revert to proxying through PHP for WordPress.org API requests.
This is to ensure we have valid installation nonces, though we've run into this as a problem previously (see <a href="http://core.trac.wordpress.org/ticket/27639">#27639</a>, <a href="http://core.trac.wordpress.org/ticket/27581">#27581</a>, <a href="http://core.trac.wordpress.org/ticket/27055">#27055</a>).
A tad slower, but we gained speed in 3.9 by simplifying the request made to the API.
props ocean90.
fixes <a href="http://core.trac.wordpress.org/ticket/27798">#27798</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminadminajaxphp">trunk/src/wp-admin/admin-ajax.php</a></li>
<li><a href="#trunksrcwpadminincludesajaxactionsphp">trunk/src/wp-admin/includes/ajax-actions.php</a></li>
<li><a href="#trunksrcwpadminincludesthemephp">trunk/src/wp-admin/includes/theme.php</a></li>
<li><a href="#trunksrcwpadminjsthemejs">trunk/src/wp-admin/js/theme.js</a></li>
<li><a href="#trunksrcwpadminthemeinstallphp">trunk/src/wp-admin/theme-install.php</a></li>
<li><a href="#trunksrcwpadminupdatephp">trunk/src/wp-admin/update.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminadminajaxphp"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/admin-ajax.php (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/admin-ajax.php 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/admin-ajax.php 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -58,7 +58,7 @@
</span><span class="cx"> 'wp-remove-post-lock', 'dismiss-wp-pointer', 'upload-attachment', 'get-attachment',
</span><span class="cx"> 'query-attachments', 'save-attachment', 'save-attachment-compat', 'send-link-to-editor',
</span><span class="cx"> 'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs',
</span><del>- 'save-user-color-scheme', 'update-widget',
</del><ins>+ 'save-user-color-scheme', 'update-widget', 'query-themes',
</ins><span class="cx"> );
</span><span class="cx">
</span><span class="cx"> // Register core Ajax calls.
</span></span></pre></div>
<a id="trunksrcwpadminincludesajaxactionsphp"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/includes/ajax-actions.php (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/includes/ajax-actions.php 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/includes/ajax-actions.php 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -2204,3 +2204,48 @@
</span><span class="cx"> update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
</span><span class="cx"> wp_send_json_success();
</span><span class="cx"> }
</span><ins>+
+/**
+ * Get themes from themes_api().
+ *
+ * @since 3.9.0
+ */
+function wp_ajax_query_themes() {
+ global $themes_allowedtags, $theme_field_defaults;
+
+ if ( ! current_user_can( 'install_themes' ) ) {
+ wp_send_json_error();
+ }
+
+ $args = wp_parse_args( wp_unslash( $_REQUEST['request'] ), array(
+ 'per_page' => 20,
+ 'fields' => $theme_field_defaults
+ ) );
+
+ $old_filter = isset( $args['browse'] ) ? $args['browse'] : 'search';
+
+ /** This filter is documented in wp-admin/includes/class-wp-theme-install-list-table.php */
+ $args = apply_filters( 'install_themes_table_api_args_' . $old_filter, $args );
+
+ $api = themes_api( 'query_themes', $args );
+
+ if ( is_wp_error( $api ) ) {
+ wp_send_json_error();
+ }
+
+ $update_php = self_admin_url( 'update.php?action=install-theme' );
+ foreach ( $api->themes as &$theme ) {
+ $theme->install_url = add_query_arg( array(
+ 'theme' => $theme->slug,
+ '_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug )
+ ), $update_php );
+
+ $theme->name = wp_kses( $theme->name, $themes_allowedtags );
+ $theme->author = wp_kses( $theme->author, $themes_allowedtags );
+ $theme->version = wp_kses( $theme->version, $themes_allowedtags );
+ $theme->description = wp_kses( $theme->description, $themes_allowedtags );
+ $theme->num_ratings = sprintf( _n( '(based on %s rating)', '(based on %s ratings)', $theme->num_ratings ), number_format_i18n( $theme->num_ratings ) );
+ }
+
+ wp_send_json_success( $api );
+}
</ins></span></pre></div>
<a id="trunksrcwpadminincludesthemephp"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/includes/theme.php (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/includes/theme.php 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/includes/theme.php 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -346,7 +346,9 @@
</span><span class="cx"> $request = wp_remote_post( $url, $args );
</span><span class="cx">
</span><span class="cx"> if ( $ssl && is_wp_error( $request ) ) {
</span><del>- trigger_error( __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' ) . ' ' . '(WordPress could not establish a secure connection to WordPress.org. Please contact your server administrator.)', headers_sent() || WP_DEBUG ? E_USER_WARNING : E_USER_NOTICE );
</del><ins>+ if ( ! defined( 'DOING_AJAX' ) || ! DOING_AJAX ) {
+ trigger_error( __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' ) . ' ' . '(WordPress could not establish a secure connection to WordPress.org. Please contact your server administrator.)', headers_sent() || WP_DEBUG ? E_USER_WARNING : E_USER_NOTICE );
+ }
</ins><span class="cx"> $request = wp_remote_post( $http_url, $args );
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -452,4 +454,4 @@
</span><span class="cx"> */
</span><span class="cx"> $prepared_themes = apply_filters( 'wp_prepare_themes_for_js', $prepared_themes );
</span><span class="cx"> return array_values( $prepared_themes );
</span><del>-}
</del><span class="cx">\ No newline at end of file
</span><ins>+}
</ins></span></pre></div>
<a id="trunksrcwpadminjsthemejs"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/js/theme.js (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/js/theme.js 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/js/theme.js 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -22,19 +22,8 @@
</span><span class="cx"> // Adds attributes to the default data coming through the .org themes api
</span><span class="cx"> // Map `id` to `slug` for shared code
</span><span class="cx"> initialize: function() {
</span><del>- var install, description;
</del><ins>+ var description;
</ins><span class="cx">
</span><del>- // Install url for the theme
- // using the install nonce
- install = {
- action: 'install-theme',
- theme: this.get( 'slug' ),
- _wpnonce: themes.data.settings._nonceInstall
- };
-
- // Build the url query
- install = themes.data.settings.updateURI + '?' + $.param( install );
-
</del><span class="cx"> // If theme is already installed, set an attribute.
</span><span class="cx"> if ( _.indexOf( themes.data.installedThemes, this.get( 'slug' ) ) !== -1 ) {
</span><span class="cx"> this.set({ installed: true });
</span><span class="lines">@@ -42,7 +31,6 @@
</span><span class="cx">
</span><span class="cx"> // Set the attributes
</span><span class="cx"> this.set({
</span><del>- installURI: ( this.get( 'slug' ) ) ? install : false,
</del><span class="cx"> // slug is for installation, id is for existing.
</span><span class="cx"> id: this.get( 'slug' ) || this.get( 'id' )
</span><span class="cx"> });
</span><span class="lines">@@ -225,7 +213,7 @@
</span><span class="cx"> //
</span><span class="cx"> // When we are missing a cache object we fire an apiCall()
</span><span class="cx"> // which triggers events of `query:success` or `query:fail`
</span><del>- query: function( request, action ) {
</del><ins>+ query: function( request ) {
</ins><span class="cx"> /**
</span><span class="cx"> * @static
</span><span class="cx"> * @type Array
</span><span class="lines">@@ -254,7 +242,7 @@
</span><span class="cx">
</span><span class="cx"> // Otherwise, send a new API call and add it to the cache.
</span><span class="cx"> if ( ! query && ! isPaginated ) {
</span><del>- query = this.apiCall( request, action ).done( function( data ) {
</del><ins>+ query = this.apiCall( request ).done( function( data ) {
</ins><span class="cx">
</span><span class="cx"> // Update the collection with the queried data.
</span><span class="cx"> if ( data.themes ) {
</span><span class="lines">@@ -262,11 +250,6 @@
</span><span class="cx"> count = data.info.results;
</span><span class="cx"> // Store the results and the query request
</span><span class="cx"> queries.push( { themes: data.themes, request: request, total: count } );
</span><del>-
- } else if ( action ) {
- self.reset( data );
- count = 1;
- self.trigger( 'query:theme' );
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Trigger a collection refresh event
</span><span class="lines">@@ -284,7 +267,7 @@
</span><span class="cx"> } else {
</span><span class="cx"> // If it's a paginated request we need to fetch more themes...
</span><span class="cx"> if ( isPaginated ) {
</span><del>- return this.apiCall( request, action, isPaginated ).done( function( data ) {
</del><ins>+ return this.apiCall( request, isPaginated ).done( function( data ) {
</ins><span class="cx"> // Add the new themes to the current collection
</span><span class="cx"> // @todo update counter
</span><span class="cx"> self.add( data.themes );
</span><span class="lines">@@ -310,12 +293,13 @@
</span><span class="cx"> this.count = query.total;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ this.reset( query.themes );
</ins><span class="cx"> if ( ! query.total ) {
</span><span class="cx"> this.count = this.length;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- this.reset( query.themes );
</del><span class="cx"> this.trigger( 'update' );
</span><ins>+ this.trigger( 'query:success', this.count );
</ins><span class="cx"> }
</span><span class="cx"> },
</span><span class="cx">
</span><span class="lines">@@ -329,30 +313,23 @@
</span><span class="cx"> },
</span><span class="cx">
</span><span class="cx"> // Send request to api.wordpress.org/themes
</span><del>- apiCall: function( request, action, paginated ) {
-
- // Send tags (and fields) as comma-separated to keep the JSONP query string short.
- if ( request.tag && _.isArray( request.tag ) ) {
- request.tag = request.tag.join( ',' );
- }
-
- // Set request action
- if ( ! action ) {
- action = 'query_themes'
- }
-
- // JSONP request to .org API
- return $.ajax({
- url: 'https://api.wordpress.org/themes/info/1.1/?callback=?',
- dataType: 'jsonp',
- timeout: 15000, // 15 seconds
-
</del><ins>+ apiCall: function( request, paginated ) {
+ return wp.ajax.send( 'query-themes', {
+ data: {
</ins><span class="cx"> // Request data
</span><del>- data: {
- action: action,
</del><span class="cx"> request: _.extend({
</span><del>- per_page: 72,
- fields: 'description,tested,requires,rating,downloaded,downloadLink,last_updated,homepage,num_ratings'
</del><ins>+ per_page: 100,
+ fields: {
+ description: true,
+ tested: true,
+ requires: true,
+ rating: true,
+ downloaded: true,
+ downloadLink: true,
+ last_updated: true,
+ homepage: true,
+ num_ratings: true
+ }
</ins><span class="cx"> }, request)
</span><span class="cx"> },
</span><span class="cx">
</span><span class="lines">@@ -1567,7 +1544,11 @@
</span><span class="cx"> });
</span><span class="cx"> },
</span><span class="cx">
</span><del>- backToFilters: function() {
</del><ins>+ backToFilters: function( event ) {
+ if ( event ) {
+ event.preventDefault();
+ }
+
</ins><span class="cx"> $( 'body' ).removeClass( 'filters-applied' );
</span><span class="cx"> },
</span><span class="cx">
</span><span class="lines">@@ -1634,8 +1615,8 @@
</span><span class="cx"> // Handles `theme` route event
</span><span class="cx"> // Queries the API for the passed theme slug
</span><span class="cx"> themes.router.on( 'route:preview', function( slug ) {
</span><del>- request.slug = slug;
- self.view.collection.query( request, 'theme_information' );
</del><ins>+ request.theme = slug;
+ self.view.collection.query( request );
</ins><span class="cx"> });
</span><span class="cx">
</span><span class="cx"> // Handles sorting / browsing routes
</span></span></pre></div>
<a id="trunksrcwpadminthemeinstallphp"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/theme-install.php (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/theme-install.php 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/theme-install.php 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -46,9 +46,7 @@
</span><span class="cx"> 'isInstall' => true,
</span><span class="cx"> 'canInstall' => current_user_can( 'install_themes' ),
</span><span class="cx"> 'installURI' => current_user_can( 'install_themes' ) ? self_admin_url( 'theme-install.php' ) : null,
</span><del>- 'adminUrl' => parse_url( self_admin_url(), PHP_URL_PATH ),
- 'updateURI' => self_admin_url( 'update.php' ),
- '_nonceInstall' => wp_create_nonce( 'install-theme' )
</del><ins>+ 'adminUrl' => parse_url( self_admin_url(), PHP_URL_PATH )
</ins><span class="cx"> ),
</span><span class="cx"> 'l10n' => array(
</span><span class="cx"> 'addNew' => __( 'Add New Theme' ),
</span><span class="lines">@@ -56,7 +54,7 @@
</span><span class="cx"> 'searchPlaceholder' => __( 'Search themes...' ), // placeholder (no ellipsis)
</span><span class="cx"> 'upload' => __( 'Upload Theme' ),
</span><span class="cx"> 'back' => __( 'Back' ),
</span><del>- 'error' => sprintf( __( 'An unexpected error occurred and we can᾿t reach WordPress.org. If you continue to have problems, please try the <a href="%s">support forums</a>.' ), __( 'https://wordpress.org/support/' ) )
</del><ins>+ 'error' => __( 'An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration. If you continue to have problems, please try the <a href="https://wordpress.org/support/">support forums</a>.' )
</ins><span class="cx"> ),
</span><span class="cx"> 'installedThemes' => array_keys( $installed_themes ),
</span><span class="cx"> 'browse' => array(
</span><span class="lines">@@ -199,7 +197,7 @@
</span><span class="cx"> <h3 class="theme-name">{{ data.name }}</h3>
</span><span class="cx">
</span><span class="cx"> <div class="theme-actions">
</span><del>- <a class="button button-primary" href="{{ data.installURI }}"><?php esc_html_e( 'Install' ); ?></a>
</del><ins>+ <a class="button button-primary" href="{{ data.install_url }}"><?php esc_html_e( 'Install' ); ?></a>
</ins><span class="cx"> <a class="button button-secondary preview install-theme-preview" href="#"><?php esc_html_e( 'Preview' ); ?></a>
</span><span class="cx"> </div>
</span><span class="cx">
</span><span class="lines">@@ -215,7 +213,7 @@
</span><span class="cx"> <# if ( data.installed ) { #>
</span><span class="cx"> <a href="#" class="button button-primary theme-install disabled"><?php _e( 'Installed' ); ?></a>
</span><span class="cx"> <# } else { #>
</span><del>- <a href="{{ data.installURI }}" class="button button-primary theme-install"><?php _e( 'Install' ); ?></a>
</del><ins>+ <a href="{{ data.install_url }}" class="button button-primary theme-install"><?php _e( 'Install' ); ?></a>
</ins><span class="cx"> <# } #>
</span><span class="cx"> </div>
</span><span class="cx"> <div class="wp-full-overlay-sidebar-content">
</span><span class="lines">@@ -233,7 +231,7 @@
</span><span class="cx"> <span class="four"></span>
</span><span class="cx"> <span class="five"></span>
</span><span class="cx"> <# if ( data.num_ratings ) { #>
</span><del>- <p class="ratings">({{ data.num_ratings }})</p>
</del><ins>+ <p class="ratings">{{ data.num_ratings }}</p>
</ins><span class="cx"> <# } else { #>
</span><span class="cx"> <p class="ratings"><?php _e( 'No ratings.' ); ?></p>
</span><span class="cx"> <# } #>
</span></span></pre></div>
<a id="trunksrcwpadminupdatephp"></a>
<div class="modfile"><h4>Modified: trunk/src/wp-admin/update.php (28125 => 28126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/src/wp-admin/update.php 2014-04-14 23:55:04 UTC (rev 28125)
+++ trunk/src/wp-admin/update.php 2014-04-15 01:15:43 UTC (rev 28126)
</span><span class="lines">@@ -202,7 +202,7 @@
</span><span class="cx">
</span><span class="cx"> include_once ABSPATH . 'wp-admin/includes/theme-install.php'; //for themes_api..
</span><span class="cx">
</span><del>- check_admin_referer( 'install-theme' );
</del><ins>+ check_admin_referer( 'install-theme_' . $theme );
</ins><span class="cx"> $api = themes_api('theme_information', array('slug' => $theme, 'fields' => array('sections' => false, 'tags' => false) ) ); //Save on a bit of bandwidth.
</span><span class="cx">
</span><span class="cx"> if ( is_wp_error($api) )
</span></span></pre>
</div>
</div>
</body>
</html>