Edit File by line

$this->pending_starter_content_settings_ids[] = $nav_menu_setting_id;

[1500] Fix | Delete

[1501] Fix | Delete

// @todo Add support for menu_item_parent.

[1502] Fix | Delete

$position = 0;

[1503] Fix | Delete

foreach ( $nav_menu['items'] as $nav_menu_item ) {

[1504] Fix | Delete

$nav_menu_item_setting_id = sprintf( 'nav_menu_item[%d]', $placeholder_id-- );

[1505] Fix | Delete

if ( ! isset( $nav_menu_item['position'] ) ) {

[1506] Fix | Delete

$nav_menu_item['position'] = $position++;

[1507] Fix | Delete

}

[1508] Fix | Delete

$nav_menu_item['nav_menu_term_id'] = $nav_menu_term_id;

[1509] Fix | Delete

[1510] Fix | Delete

if ( isset( $nav_menu_item['object_id'] ) ) {

[1511] Fix | Delete

if ( 'post_type' === $nav_menu_item['type'] && preg_match( '/^{{(?P<symbol>.+)}}$/', $nav_menu_item['object_id'], $matches ) && isset( $posts[ $matches['symbol'] ] ) ) {

[1512] Fix | Delete

$nav_menu_item['object_id'] = $posts[ $matches['symbol'] ]['ID'];

[1513] Fix | Delete

if ( empty( $nav_menu_item['title'] ) ) {

[1514] Fix | Delete

$original_object = get_post( $nav_menu_item['object_id'] );

[1515] Fix | Delete

$nav_menu_item['title'] = $original_object->post_title;

[1516] Fix | Delete

}

[1517] Fix | Delete

} else {

[1518] Fix | Delete

continue;

[1519] Fix | Delete

}

[1520] Fix | Delete

} else {

[1521] Fix | Delete

$nav_menu_item['object_id'] = 0;

[1522] Fix | Delete

}

[1523] Fix | Delete

[1524] Fix | Delete

if ( empty( $changeset_data[ $nav_menu_item_setting_id ] ) || ! empty( $changeset_data[ $nav_menu_item_setting_id ]['starter_content'] ) ) {

[1525] Fix | Delete

$this->set_post_value( $nav_menu_item_setting_id, $nav_menu_item );

[1526] Fix | Delete

$this->pending_starter_content_settings_ids[] = $nav_menu_item_setting_id;

[1527] Fix | Delete

}

[1528] Fix | Delete

}

[1529] Fix | Delete

[1530] Fix | Delete

$setting_id = sprintf( 'nav_menu_locations[%s]', $nav_menu_location );

[1531] Fix | Delete

if ( empty( $changeset_data[ $setting_id ] ) || ! empty( $changeset_data[ $setting_id ]['starter_content'] ) ) {

[1532] Fix | Delete

$this->set_post_value( $setting_id, $nav_menu_term_id );

[1533] Fix | Delete

$this->pending_starter_content_settings_ids[] = $setting_id;

[1534] Fix | Delete

}

[1535] Fix | Delete

}

[1536] Fix | Delete

[1537] Fix | Delete

// Options.

[1538] Fix | Delete

foreach ( $options as $name => $value ) {

[1539] Fix | Delete

[1540] Fix | Delete

// Serialize the value to check for post symbols.

[1541] Fix | Delete

$value = maybe_serialize( $value );

[1542] Fix | Delete

[1543] Fix | Delete

if ( is_serialized( $value ) ) {

[1544] Fix | Delete

if ( preg_match( '/s:\d+:"{{(?P<symbol>.+)}}"/', $value, $matches ) ) {

[1545] Fix | Delete

if ( isset( $posts[ $matches['symbol'] ] ) ) {

[1546] Fix | Delete

$symbol_match = $posts[ $matches['symbol'] ]['ID'];

[1547] Fix | Delete

} elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) {

[1548] Fix | Delete

$symbol_match = $attachment_ids[ $matches['symbol'] ];

[1549] Fix | Delete

}

[1550] Fix | Delete

[1551] Fix | Delete

// If we have any symbol matches, update the values.

[1552] Fix | Delete

if ( isset( $symbol_match ) ) {

[1553] Fix | Delete

// Replace found string matches with post IDs.

[1554] Fix | Delete

$value = str_replace( $matches[0], "i:{$symbol_match}", $value );

[1555] Fix | Delete

} else {

[1556] Fix | Delete

continue;

[1557] Fix | Delete

}

[1558] Fix | Delete

}

[1559] Fix | Delete

} elseif ( preg_match( '/^{{(?P<symbol>.+)}}$/', $value, $matches ) ) {

[1560] Fix | Delete

if ( isset( $posts[ $matches['symbol'] ] ) ) {

[1561] Fix | Delete

$value = $posts[ $matches['symbol'] ]['ID'];

[1562] Fix | Delete

} elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) {

[1563] Fix | Delete

$value = $attachment_ids[ $matches['symbol'] ];

[1564] Fix | Delete

} else {

[1565] Fix | Delete

continue;

[1566] Fix | Delete

}

[1567] Fix | Delete

}

[1568] Fix | Delete

[1569] Fix | Delete

// Unserialize values after checking for post symbols, so they can be properly referenced.

[1570] Fix | Delete

$value = maybe_unserialize( $value );

[1571] Fix | Delete

[1572] Fix | Delete

if ( empty( $changeset_data[ $name ] ) || ! empty( $changeset_data[ $name ]['starter_content'] ) ) {

[1573] Fix | Delete

$this->set_post_value( $name, $value );

[1574] Fix | Delete

$this->pending_starter_content_settings_ids[] = $name;

[1575] Fix | Delete

}

[1576] Fix | Delete

}

[1577] Fix | Delete

[1578] Fix | Delete

// Theme mods.

[1579] Fix | Delete

foreach ( $theme_mods as $name => $value ) {

[1580] Fix | Delete

[1581] Fix | Delete

// Serialize the value to check for post symbols.

[1582] Fix | Delete

$value = maybe_serialize( $value );

[1583] Fix | Delete

[1584] Fix | Delete

// Check if value was serialized.

[1585] Fix | Delete

if ( is_serialized( $value ) ) {

[1586] Fix | Delete

if ( preg_match( '/s:\d+:"{{(?P<symbol>.+)}}"/', $value, $matches ) ) {

[1587] Fix | Delete

if ( isset( $posts[ $matches['symbol'] ] ) ) {

[1588] Fix | Delete

$symbol_match = $posts[ $matches['symbol'] ]['ID'];

[1589] Fix | Delete

} elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) {

[1590] Fix | Delete

$symbol_match = $attachment_ids[ $matches['symbol'] ];

[1591] Fix | Delete

}

[1592] Fix | Delete

[1593] Fix | Delete

// If we have any symbol matches, update the values.

[1594] Fix | Delete

if ( isset( $symbol_match ) ) {

[1595] Fix | Delete

// Replace found string matches with post IDs.

[1596] Fix | Delete

$value = str_replace( $matches[0], "i:{$symbol_match}", $value );

[1597] Fix | Delete

} else {

[1598] Fix | Delete

continue;

[1599] Fix | Delete

}

[1600] Fix | Delete

}

[1601] Fix | Delete

} elseif ( preg_match( '/^{{(?P<symbol>.+)}}$/', $value, $matches ) ) {

[1602] Fix | Delete

if ( isset( $posts[ $matches['symbol'] ] ) ) {

[1603] Fix | Delete

$value = $posts[ $matches['symbol'] ]['ID'];

[1604] Fix | Delete

} elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) {

[1605] Fix | Delete

$value = $attachment_ids[ $matches['symbol'] ];

[1606] Fix | Delete

} else {

[1607] Fix | Delete

continue;

[1608] Fix | Delete

}

[1609] Fix | Delete

}

[1610] Fix | Delete

[1611] Fix | Delete

// Unserialize values after checking for post symbols, so they can be properly referenced.

[1612] Fix | Delete

$value = maybe_unserialize( $value );

[1613] Fix | Delete

[1614] Fix | Delete

// Handle header image as special case since setting has a legacy format.

[1615] Fix | Delete

if ( 'header_image' === $name ) {

[1616] Fix | Delete

$name = 'header_image_data';

[1617] Fix | Delete

$metadata = wp_get_attachment_metadata( $value );

[1618] Fix | Delete

if ( empty( $metadata ) ) {

[1619] Fix | Delete

continue;

[1620] Fix | Delete

}

[1621] Fix | Delete

$value = array(

[1622] Fix | Delete

'attachment_id' => $value,

[1623] Fix | Delete

'url' => wp_get_attachment_url( $value ),

[1624] Fix | Delete

'height' => $metadata['height'],

[1625] Fix | Delete

'width' => $metadata['width'],

[1626] Fix | Delete

);

[1627] Fix | Delete

} elseif ( 'background_image' === $name ) {

[1628] Fix | Delete

$value = wp_get_attachment_url( $value );

[1629] Fix | Delete

}

[1630] Fix | Delete

[1631] Fix | Delete

if ( empty( $changeset_data[ $name ] ) || ! empty( $changeset_data[ $name ]['starter_content'] ) ) {

[1632] Fix | Delete

$this->set_post_value( $name, $value );

[1633] Fix | Delete

$this->pending_starter_content_settings_ids[] = $name;

[1634] Fix | Delete

}

[1635] Fix | Delete

}

[1636] Fix | Delete

[1637] Fix | Delete

if ( ! empty( $this->pending_starter_content_settings_ids ) ) {

[1638] Fix | Delete

if ( did_action( 'customize_register' ) ) {

[1639] Fix | Delete

$this->_save_starter_content_changeset();

[1640] Fix | Delete

} else {

[1641] Fix | Delete

add_action( 'customize_register', array( $this, '_save_starter_content_changeset' ), 1000 );

[1642] Fix | Delete

}

[1643] Fix | Delete

}

[1644] Fix | Delete

}

[1645] Fix | Delete

[1646] Fix | Delete

/**

[1647] Fix | Delete

* Prepares starter content attachments.

[1648] Fix | Delete

[1649] Fix | Delete

* Ensure that the attachments are valid and that they have slugs and file name/path.

[1650] Fix | Delete

[1651] Fix | Delete

* @since 4.7.0

[1652] Fix | Delete

[1653] Fix | Delete

* @param array $attachments Attachments.

[1654] Fix | Delete

* @return array Prepared attachments.

[1655] Fix | Delete

[1656] Fix | Delete

protected function prepare_starter_content_attachments( $attachments ) {

[1657] Fix | Delete

$prepared_attachments = array();

[1658] Fix | Delete

if ( empty( $attachments ) ) {

[1659] Fix | Delete

return $prepared_attachments;

[1660] Fix | Delete

}

[1661] Fix | Delete

[1662] Fix | Delete

// Such is The WordPress Way.

[1663] Fix | Delete

require_once ABSPATH . 'wp-admin/includes/file.php';

[1664] Fix | Delete

require_once ABSPATH . 'wp-admin/includes/media.php';

[1665] Fix | Delete

require_once ABSPATH . 'wp-admin/includes/image.php';

[1666] Fix | Delete

[1667] Fix | Delete

foreach ( $attachments as $symbol => $attachment ) {

[1668] Fix | Delete

[1669] Fix | Delete

// A file is required and URLs to files are not currently allowed.

[1670] Fix | Delete

if ( empty( $attachment['file'] ) || preg_match( '#^https?://$#', $attachment['file'] ) ) {

[1671] Fix | Delete

continue;

[1672] Fix | Delete

}

[1673] Fix | Delete

[1674] Fix | Delete

$file_path = null;

[1675] Fix | Delete

if ( file_exists( $attachment['file'] ) ) {

[1676] Fix | Delete

$file_path = $attachment['file']; // Could be absolute path to file in plugin.

[1677] Fix | Delete

} elseif ( is_child_theme() && file_exists( get_stylesheet_directory() . '/' . $attachment['file'] ) ) {

[1678] Fix | Delete

$file_path = get_stylesheet_directory() . '/' . $attachment['file'];

[1679] Fix | Delete

} elseif ( file_exists( get_template_directory() . '/' . $attachment['file'] ) ) {

[1680] Fix | Delete

$file_path = get_template_directory() . '/' . $attachment['file'];

[1681] Fix | Delete

} else {

[1682] Fix | Delete

continue;

[1683] Fix | Delete

}

[1684] Fix | Delete

$file_name = wp_basename( $attachment['file'] );

[1685] Fix | Delete

[1686] Fix | Delete

// Skip file types that are not recognized.

[1687] Fix | Delete

$checked_filetype = wp_check_filetype( $file_name );

[1688] Fix | Delete

if ( empty( $checked_filetype['type'] ) ) {

[1689] Fix | Delete

continue;

[1690] Fix | Delete

}

[1691] Fix | Delete

[1692] Fix | Delete

// Ensure post_name is set since not automatically derived from post_title for new auto-draft posts.

[1693] Fix | Delete

if ( empty( $attachment['post_name'] ) ) {

[1694] Fix | Delete

if ( ! empty( $attachment['post_title'] ) ) {

[1695] Fix | Delete

$attachment['post_name'] = sanitize_title( $attachment['post_title'] );

[1696] Fix | Delete

} else {

[1697] Fix | Delete

$attachment['post_name'] = sanitize_title( preg_replace( '/\.\w+$/', '', $file_name ) );

[1698] Fix | Delete

}

[1699] Fix | Delete

}

[1700] Fix | Delete

[1701] Fix | Delete

$attachment['file_name'] = $file_name;

[1702] Fix | Delete

$attachment['file_path'] = $file_path;

[1703] Fix | Delete

$prepared_attachments[ $symbol ] = $attachment;

[1704] Fix | Delete

}

[1705] Fix | Delete

return $prepared_attachments;

[1706] Fix | Delete

}

[1707] Fix | Delete

[1708] Fix | Delete

/**

[1709] Fix | Delete

* Saves starter content changeset.

[1710] Fix | Delete

[1711] Fix | Delete

* @since 4.7.0

[1712] Fix | Delete

[1713] Fix | Delete

public function _save_starter_content_changeset() {

[1714] Fix | Delete

[1715] Fix | Delete

if ( empty( $this->pending_starter_content_settings_ids ) ) {

[1716] Fix | Delete

return;

[1717] Fix | Delete

}

[1718] Fix | Delete

[1719] Fix | Delete

$this->save_changeset_post(

[1720] Fix | Delete

array(

[1721] Fix | Delete

'data' => array_fill_keys( $this->pending_starter_content_settings_ids, array( 'starter_content' => true ) ),

[1722] Fix | Delete

'starter_content' => true,

[1723] Fix | Delete

)

[1724] Fix | Delete

);

[1725] Fix | Delete

$this->saved_starter_content_changeset = true;

[1726] Fix | Delete

[1727] Fix | Delete

$this->pending_starter_content_settings_ids = array();

[1728] Fix | Delete

}

[1729] Fix | Delete

[1730] Fix | Delete

/**

[1731] Fix | Delete

* Gets dirty pre-sanitized setting values in the current customized state.

[1732] Fix | Delete

[1733] Fix | Delete

* The returned array consists of a merge of three sources:

[1734] Fix | Delete

* 1. If the theme is not currently active, then the base array is any stashed

[1735] Fix | Delete

* theme mods that were modified previously but never published.

[1736] Fix | Delete

* 2. The values from the current changeset, if it exists.

[1737] Fix | Delete

* 3. If the user can customize, the values parsed from the incoming

[1738] Fix | Delete

* `$_POST['customized']` JSON data.

[1739] Fix | Delete

* 4. Any programmatically-set post values via `WP_Customize_Manager::set_post_value()`.

[1740] Fix | Delete

[1741] Fix | Delete

* The name "unsanitized_post_values" is a carry-over from when the customized

[1742] Fix | Delete

* state was exclusively sourced from `$_POST['customized']`. Nevertheless,

[1743] Fix | Delete

* the value returned will come from the current changeset post and from the

[1744] Fix | Delete

* incoming post data.

[1745] Fix | Delete

[1746] Fix | Delete

* @since 4.1.1

[1747] Fix | Delete

* @since 4.7.0 Added `$args` parameter and merging with changeset values and stashed theme mods.

[1748] Fix | Delete

[1749] Fix | Delete

* @param array $args {

[1750] Fix | Delete

* Args.

[1751] Fix | Delete

[1752] Fix | Delete

* @type bool $exclude_changeset Whether the changeset values should also be excluded. Defaults to false.

[1753] Fix | Delete

* @type bool $exclude_post_data Whether the post input values should also be excluded. Defaults to false when lacking the customize capability.

[1754] Fix | Delete

* }

[1755] Fix | Delete

* @return array

[1756] Fix | Delete

[1757] Fix | Delete

public function unsanitized_post_values( $args = array() ) {

[1758] Fix | Delete

$args = array_merge(

[1759] Fix | Delete

array(

[1760] Fix | Delete

'exclude_changeset' => false,

[1761] Fix | Delete

'exclude_post_data' => ! current_user_can( 'customize' ),

[1762] Fix | Delete

[1763] Fix | Delete

$args

[1764] Fix | Delete

);

[1765] Fix | Delete

[1766] Fix | Delete

$values = array();

[1767] Fix | Delete

[1768] Fix | Delete

// Let default values be from the stashed theme mods if doing a theme switch and if no changeset is present.

[1769] Fix | Delete

if ( ! $this->is_theme_active() ) {

[1770] Fix | Delete

$stashed_theme_mods = get_option( 'customize_stashed_theme_mods' );

[1771] Fix | Delete

$stylesheet = $this->get_stylesheet();

[1772] Fix | Delete

if ( isset( $stashed_theme_mods[ $stylesheet ] ) ) {

[1773] Fix | Delete

$values = array_merge( $values, wp_list_pluck( $stashed_theme_mods[ $stylesheet ], 'value' ) );

[1774] Fix | Delete

}

[1775] Fix | Delete

}

[1776] Fix | Delete

[1777] Fix | Delete

if ( ! $args['exclude_changeset'] ) {

[1778] Fix | Delete

foreach ( $this->changeset_data() as $setting_id => $setting_params ) {

[1779] Fix | Delete

if ( ! array_key_exists( 'value', $setting_params ) ) {

[1780] Fix | Delete

continue;

[1781] Fix | Delete

}

[1782] Fix | Delete

if ( isset( $setting_params['type'] ) && 'theme_mod' === $setting_params['type'] ) {

[1783] Fix | Delete

[1784] Fix | Delete

// Ensure that theme mods values are only used if they were saved under the active theme.

[1785] Fix | Delete

$namespace_pattern = '/^(?P<stylesheet>.+?)::(?P<setting_id>.+)$/';

[1786] Fix | Delete

if ( preg_match( $namespace_pattern, $setting_id, $matches ) && $this->get_stylesheet() === $matches['stylesheet'] ) {

[1787] Fix | Delete

$values[ $matches['setting_id'] ] = $setting_params['value'];

[1788] Fix | Delete

}

[1789] Fix | Delete

} else {

[1790] Fix | Delete

$values[ $setting_id ] = $setting_params['value'];

[1791] Fix | Delete

}

[1792] Fix | Delete

}

[1793] Fix | Delete

}

[1794] Fix | Delete

[1795] Fix | Delete

if ( ! $args['exclude_post_data'] ) {

[1796] Fix | Delete

if ( ! isset( $this->_post_values ) ) {

[1797] Fix | Delete

if ( isset( $_POST['customized'] ) ) {

[1798] Fix | Delete

$post_values = json_decode( wp_unslash( $_POST['customized'] ), true );

[1799] Fix | Delete

} else {

[1800] Fix | Delete

$post_values = array();

[1801] Fix | Delete

}

[1802] Fix | Delete

if ( is_array( $post_values ) ) {

[1803] Fix | Delete

$this->_post_values = $post_values;

[1804] Fix | Delete

} else {

[1805] Fix | Delete

$this->_post_values = array();

[1806] Fix | Delete

}

[1807] Fix | Delete

}

[1808] Fix | Delete

$values = array_merge( $values, $this->_post_values );

[1809] Fix | Delete

}

[1810] Fix | Delete

return $values;

[1811] Fix | Delete

}

[1812] Fix | Delete

[1813] Fix | Delete

/**

[1814] Fix | Delete

* Returns the sanitized value for a given setting from the current customized state.

[1815] Fix | Delete

[1816] Fix | Delete

* The name "post_value" is a carry-over from when the customized state was exclusively

[1817] Fix | Delete

* sourced from `$_POST['customized']`. Nevertheless, the value returned will come

[1818] Fix | Delete

* from the current changeset post and from the incoming post data.

[1819] Fix | Delete

[1820] Fix | Delete

* @since 3.4.0

[1821] Fix | Delete

* @since 4.1.1 Introduced the `$default_value` parameter.

[1822] Fix | Delete

* @since 4.6.0 `$default_value` is now returned early when the setting post value is invalid.

[1823] Fix | Delete

[1824] Fix | Delete

* @see WP_REST_Server::dispatch()

[1825] Fix | Delete

* @see WP_REST_Request::sanitize_params()

[1826] Fix | Delete

* @see WP_REST_Request::has_valid_params()

[1827] Fix | Delete

[1828] Fix | Delete

* @param WP_Customize_Setting $setting A WP_Customize_Setting derived object.

[1829] Fix | Delete

* @param mixed $default_value Value returned if `$setting` has no post value (added in 4.2.0)

[1830] Fix | Delete

* or the post value is invalid (added in 4.6.0).

[1831] Fix | Delete

* @return string|mixed Sanitized value or the `$default_value` provided.

[1832] Fix | Delete

[1833] Fix | Delete

public function post_value( $setting, $default_value = null ) {

[1834] Fix | Delete

$post_values = $this->unsanitized_post_values();

[1835] Fix | Delete

if ( ! array_key_exists( $setting->id, $post_values ) ) {

[1836] Fix | Delete

return $default_value;

[1837] Fix | Delete

}

[1838] Fix | Delete

[1839] Fix | Delete

$value = $post_values[ $setting->id ];

[1840] Fix | Delete

$valid = $setting->validate( $value );

[1841] Fix | Delete

if ( is_wp_error( $valid ) ) {

[1842] Fix | Delete

return $default_value;

[1843] Fix | Delete

}

[1844] Fix | Delete

[1845] Fix | Delete

$value = $setting->sanitize( $value );

[1846] Fix | Delete

if ( is_null( $value ) || is_wp_error( $value ) ) {

[1847] Fix | Delete

return $default_value;

[1848] Fix | Delete

}

[1849] Fix | Delete

[1850] Fix | Delete

return $value;

[1851] Fix | Delete

}

[1852] Fix | Delete

[1853] Fix | Delete

/**

[1854] Fix | Delete

* Overrides a setting's value in the current customized state.

[1855] Fix | Delete

[1856] Fix | Delete

* The name "post_value" is a carry-over from when the customized state was

[1857] Fix | Delete

* exclusively sourced from `$_POST['customized']`.

[1858] Fix | Delete

[1859] Fix | Delete

* @since 4.2.0

[1860] Fix | Delete

[1861] Fix | Delete

* @param string $setting_id ID for the WP_Customize_Setting instance.

[1862] Fix | Delete

* @param mixed $value Post value.

[1863] Fix | Delete

[1864] Fix | Delete

public function set_post_value( $setting_id, $value ) {

[1865] Fix | Delete

$this->unsanitized_post_values(); // Populate _post_values from $_POST['customized'].

[1866] Fix | Delete

$this->_post_values[ $setting_id ] = $value;

[1867] Fix | Delete

[1868] Fix | Delete

/**

[1869] Fix | Delete

* Announces when a specific setting's unsanitized post value has been set.

[1870] Fix | Delete

[1871] Fix | Delete

* Fires when the WP_Customize_Manager::set_post_value() method is called.

[1872] Fix | Delete

[1873] Fix | Delete

* The dynamic portion of the hook name, `$setting_id`, refers to the setting ID.

[1874] Fix | Delete

[1875] Fix | Delete

* @since 4.4.0

[1876] Fix | Delete

[1877] Fix | Delete

* @param mixed $value Unsanitized setting post value.

[1878] Fix | Delete

* @param WP_Customize_Manager $manager WP_Customize_Manager instance.

[1879] Fix | Delete

[1880] Fix | Delete

do_action( "customize_post_value_set_{$setting_id}", $value, $this );

[1881] Fix | Delete

[1882] Fix | Delete

/**

[1883] Fix | Delete

* Announces when any setting's unsanitized post value has been set.

[1884] Fix | Delete

[1885] Fix | Delete

* Fires when the WP_Customize_Manager::set_post_value() method is called.

[1886] Fix | Delete

[1887] Fix | Delete

* This is useful for `WP_Customize_Setting` instances to watch

[1888] Fix | Delete

* in order to update a cached previewed value.

[1889] Fix | Delete

[1890] Fix | Delete

* @since 4.4.0

[1891] Fix | Delete

[1892] Fix | Delete

* @param string $setting_id Setting ID.

[1893] Fix | Delete

* @param mixed $value Unsanitized setting post value.

[1894] Fix | Delete

* @param WP_Customize_Manager $manager WP_Customize_Manager instance.

[1895] Fix | Delete

[1896] Fix | Delete

do_action( 'customize_post_value_set', $setting_id, $value, $this );

[1897] Fix | Delete

}

[1898] Fix | Delete

[1899] Fix | Delete

/**

[1900] Fix | Delete

* Prints JavaScript settings.

[1901] Fix | Delete

[1902] Fix | Delete

* @since 3.4.0

[1903] Fix | Delete

[1904] Fix | Delete

public function customize_preview_init() {

[1905] Fix | Delete

[1906] Fix | Delete

[1907] Fix | Delete

* Now that Customizer previews are loaded into iframes via GET requests

[1908] Fix | Delete

* and natural URLs with transaction UUIDs added, we need to ensure that

[1909] Fix | Delete

* the responses are never cached by proxies. In practice, this will not

[1910] Fix | Delete

* be needed if the user is logged-in anyway. But if anonymous access is

[1911] Fix | Delete

* allowed then the auth cookies would not be sent and WordPress would

[1912] Fix | Delete

* not send no-cache headers by default.

[1913] Fix | Delete

[1914] Fix | Delete

if ( ! headers_sent() ) {

[1915] Fix | Delete

nocache_headers();

[1916] Fix | Delete

header( 'X-Robots: noindex, nofollow, noarchive' );

[1917] Fix | Delete

header( 'X-Robots-Tag: noindex, nofollow, noarchive' );

[1918] Fix | Delete

}

[1919] Fix | Delete

add_filter( 'wp_robots', 'wp_robots_no_robots' );

[1920] Fix | Delete

add_filter( 'wp_headers', array( $this, 'filter_iframe_security_headers' ) );

[1921] Fix | Delete

[1922] Fix | Delete

[1923] Fix | Delete

* If preview is being served inside the customizer preview iframe, and

[1924] Fix | Delete

* if the user doesn't have customize capability, then it is assumed

[1925] Fix | Delete

* that the user's session has expired and they need to re-authenticate.

[1926] Fix | Delete

[1927] Fix | Delete

if ( $this->messenger_channel && ! current_user_can( 'customize' ) ) {

[1928] Fix | Delete

$this->wp_die(

[1929] Fix | Delete

-1,

[1930] Fix | Delete

sprintf(

[1931] Fix | Delete

/* translators: %s: customize_messenger_channel */

[1932] Fix | Delete

__( 'Unauthorized. You may remove the %s param to preview as frontend.' ),

[1933] Fix | Delete

'<code>customize_messenger_channel<code>'

[1934] Fix | Delete

)

[1935] Fix | Delete

);

[1936] Fix | Delete

return;

[1937] Fix | Delete

}

[1938] Fix | Delete

[1939] Fix | Delete

$this->prepare_controls();

[1940] Fix | Delete

[1941] Fix | Delete

add_filter( 'wp_redirect', array( $this, 'add_state_query_params' ) );

[1942] Fix | Delete

[1943] Fix | Delete

wp_enqueue_script( 'customize-preview' );

[1944] Fix | Delete

wp_enqueue_style( 'customize-preview' );

[1945] Fix | Delete

add_action( 'wp_head', array( $this, 'customize_preview_loading_style' ) );

[1946] Fix | Delete

add_action( 'wp_head', array( $this, 'remove_frameless_preview_messenger_channel' ) );

[1947] Fix | Delete

add_action( 'wp_footer', array( $this, 'customize_preview_settings' ), 20 );

[1948] Fix | Delete

add_filter( 'get_edit_post_link', '__return_empty_string' );

[1949] Fix | Delete

[1950] Fix | Delete

/**

[1951] Fix | Delete

* Fires once the Customizer preview has initialized and JavaScript

[1952] Fix | Delete

* settings have been printed.

[1953] Fix | Delete

[1954] Fix | Delete

* @since 3.4.0

[1955] Fix | Delete

[1956] Fix | Delete

* @param WP_Customize_Manager $manager WP_Customize_Manager instance.

[1957] Fix | Delete

[1958] Fix | Delete

do_action( 'customize_preview_init', $this );

[1959] Fix | Delete

}

[1960] Fix | Delete

[1961] Fix | Delete

/**

[1962] Fix | Delete

* Filters the X-Frame-Options and Content-Security-Policy headers to ensure frontend can load in customizer.

[1963] Fix | Delete

[1964] Fix | Delete

* @since 4.7.0

[1965] Fix | Delete

[1966] Fix | Delete

* @param array $headers Headers.

[1967] Fix | Delete

* @return array Headers.

[1968] Fix | Delete

[1969] Fix | Delete

public function filter_iframe_security_headers( $headers ) {

[1970] Fix | Delete

$headers['X-Frame-Options'] = 'SAMEORIGIN';

[1971] Fix | Delete

$headers['Content-Security-Policy'] = "frame-ancestors 'self'";

[1972] Fix | Delete

return $headers;

[1973] Fix | Delete

}

[1974] Fix | Delete

[1975] Fix | Delete

/**

[1976] Fix | Delete

* Adds customize state query params to a given URL if preview is allowed.

[1977] Fix | Delete

[1978] Fix | Delete

* @since 4.7.0

[1979] Fix | Delete

[1980] Fix | Delete

* @see wp_redirect()

[1981] Fix | Delete

* @see WP_Customize_Manager::get_allowed_url()

[1982] Fix | Delete

[1983] Fix | Delete

* @param string $url URL.

[1984] Fix | Delete

* @return string URL.

[1985] Fix | Delete

[1986] Fix | Delete

public function add_state_query_params( $url ) {

[1987] Fix | Delete

$parsed_original_url = wp_parse_url( $url );

[1988] Fix | Delete

$is_allowed = false;

[1989] Fix | Delete

foreach ( $this->get_allowed_urls() as $allowed_url ) {

[1990] Fix | Delete

$parsed_allowed_url = wp_parse_url( $allowed_url );

[1991] Fix | Delete

$is_allowed = (

[1992] Fix | Delete

$parsed_allowed_url['scheme'] === $parsed_original_url['scheme']

[1993] Fix | Delete

[1994] Fix | Delete

$parsed_allowed_url['host'] === $parsed_original_url['host']

[1995] Fix | Delete

[1996] Fix | Delete

str_starts_with( $parsed_original_url['path'], $parsed_allowed_url['path'] )

[1997] Fix | Delete

);

[1998] Fix | Delete

if ( $is_allowed ) {

[1999] Fix | Delete

1 2 345 6 ...13