~canonical-sysadmins/wordpress/5.1

$attributes = sprintf( ' data-customize-partial-id="%s"', esc_attr( 'nav_menu_instance[' . $args->customize_preview_nav_menus_args['args_hmac'] . ']' ) );

961

$attributes .= ' data-customize-partial-type="nav_menu_instance"';

962

$attributes .= sprintf( ' data-customize-partial-placement-context="%s"', esc_attr( wp_json_encode( $args->customize_preview_nav_menus_args ) ) );

963

$nav_menu_content = preg_replace( '#^(<\w+)#', '$1 ' . $attributes, $nav_menu_content, 1 );

902

964

}

903

965

return $nav_menu_content;

904

966

}

905

967

906

968

/**

907

* Hash (hmac) the arguments with the nonce and secret auth key to ensure they

908

* are not tampered with when submitted in the Ajax request.

969

* Hashes (hmac) the nav menu arguments to ensure they are not tampered with when

970

* submitted in the Ajax request.

971

972

* Note that the array is expected to be pre-sorted.

909

973

910

974

* @since 4.3.0

911

975

* @access public

912

976

913

977

* @param array $args The arguments to hash.

914

* @return string

978

* @return string Hashed nav menu arguments.

915

979

916

980

public function hash_nav_menu_args( $args ) {

917

return wp_hash( wp_create_nonce( self::RENDER_AJAX_ACTION ) . serialize( $args ) );

981

return wp_hash( serialize( $args ) );

918

982

}

919

983

920

984

/**

924

988

* @access public

925

989

926

990

public function customize_preview_enqueue_deps() {

927

wp_enqueue_script( 'customize-preview-nav-menus' );

991

wp_enqueue_script( 'customize-preview-nav-menus' ); // Note that we have overridden this.

928

992

wp_enqueue_style( 'customize-preview' );

929

930

add_action( 'wp_print_footer_scripts', array( $this, 'export_preview_data' ) );

931

993

}

932

994

933

995

/**

934

* Export data from PHP to JS.

996

* Exports data from PHP to JS.

935

997

936

998

* @since 4.3.0

937

999

* @access public

940

1002

941

1003

// Why not wp_localize_script? Because we're not localizing, and it forces values into strings.

942

1004

$exports = array(

943

'renderQueryVar' => self::RENDER_QUERY_VAR,

944

'renderNonceValue' => wp_create_nonce( self::RENDER_AJAX_ACTION ),

945

'renderNoncePostKey' => self::RENDER_NONCE_POST_KEY,

946

'requestUri' => empty( $_SERVER['REQUEST_URI'] ) ? home_url( '/' ) : esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ),

947

'theme' => array(

948

'stylesheet' => $this->manager->get_stylesheet(),

949

'active' => $this->manager->is_theme_active(),

950

951

'previewCustomizeNonce' => wp_create_nonce( 'preview-customize_' . $this->manager->get_stylesheet() ),

952

'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,

1005

'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,

953

1006

);

954

955

1007

printf( '<script>var _wpCustomizePreviewNavMenusExports = %s;</script>', wp_json_encode( $exports ) );

956

1008

}

957

1009

958

1010

/**

1011

* Export any wp_nav_menu() calls during the rendering of any partials.

1012

1013

* @since 4.5.0

1014

* @access public

1015

1016

* @param array $response Response.

1017

* @return array Response.

1018

1019

public function export_partial_rendered_nav_menu_instances( $response ) {

1020

$response['nav_menu_instance_args'] = $this->preview_nav_menu_instance_args;

1021

return $response;

1022

}

1023

1024

/**

959

1025

* Render a specific menu via wp_nav_menu() using the supplied arguments.

960

1026

961

1027

* @since 4.3.0

962

1028

* @access public

963

1029

964

1030

* @see wp_nav_menu()

1031

1032

* @param WP_Customize_Partial $partial Partial.

1033

* @param array $nav_menu_args Nav menu args supplied as container context.

1034

* @return string|false

965

1035

966

public function render_menu() {

967

if ( empty( $_POST[ self::RENDER_QUERY_VAR ] ) ) {

968

return;

969

}

970

971

$this->manager->remove_preview_signature();

972

973

if ( empty( $_POST[ self::RENDER_NONCE_POST_KEY ] ) ) {

974

wp_send_json_error( 'missing_nonce_param' );

975

}

976

977

if ( ! is_customize_preview() ) {

978

wp_send_json_error( 'expected_customize_preview' );

979

}

980

981

if ( ! check_ajax_referer( self::RENDER_AJAX_ACTION, self::RENDER_NONCE_POST_KEY, false ) ) {

982

wp_send_json_error( 'nonce_check_fail' );

983

}

984

985

if ( ! current_user_can( 'edit_theme_options' ) ) {

986

wp_send_json_error( 'unauthorized' );

987

}

988

989

if ( ! isset( $_POST['wp_nav_menu_args'] ) ) {

990

wp_send_json_error( 'missing_param' );

991

}

992

993

if ( ! isset( $_POST['wp_nav_menu_args_hash'] ) ) {

994

wp_send_json_error( 'missing_param' );

995

}

996

997

$wp_nav_menu_args = json_decode( wp_unslash( $_POST['wp_nav_menu_args'] ), true );

998

if ( ! is_array( $wp_nav_menu_args ) ) {

999

wp_send_json_error( 'wp_nav_menu_args_not_array' );

1000

}

1001

1002

$wp_nav_menu_args_hash = sanitize_text_field( wp_unslash( $_POST['wp_nav_menu_args_hash'] ) );

1003

if ( ! hash_equals( $this->hash_nav_menu_args( $wp_nav_menu_args ), $wp_nav_menu_args_hash ) ) {

1004

wp_send_json_error( 'wp_nav_menu_args_hash_mismatch' );

1005

}

1006

1007

$wp_nav_menu_args['echo'] = false;

1008

wp_send_json_success( wp_nav_menu( $wp_nav_menu_args ) );

1036

public function render_nav_menu_partial( $partial, $nav_menu_args ) {

1037

unset( $partial );

1038

1039

if ( ! isset( $nav_menu_args['args_hmac'] ) ) {

1040

// Error: missing_args_hmac.

1041

return false;

1042

}

1043

1044

$nav_menu_args_hmac = $nav_menu_args['args_hmac'];

1045

unset( $nav_menu_args['args_hmac'] );

1046

1047

ksort( $nav_menu_args );

1048

if ( ! hash_equals( $this->hash_nav_menu_args( $nav_menu_args ), $nav_menu_args_hmac ) ) {

1049

// Error: args_hmac_mismatch.

1050

return false;

1051

}

1052

1053

ob_start();

1054

wp_nav_menu( $nav_menu_args );

1055

$content = ob_get_clean();

1056

1057

return $content;

1009

1058

}

1010

1059

}

Older »