Skip to content

Refresh nonces with heartbeat responses#677

Merged
dlh01 merged 10 commits intomasterfrom
627-refresh-nonces
Feb 16, 2021
Merged

Refresh nonces with heartbeat responses#677
dlh01 merged 10 commits intomasterfrom
627-refresh-nonces

Conversation

@dlh01
Copy link
Copy Markdown
Member

@dlh01 dlh01 commented Dec 4, 2017

See #627.

The implementation in this PR makes a filter for wp_refresh_nonces available to all contexts by placing it on the base Fieldmanager_Context class. However, to add the filter, custom contexts would need to add calls to parent::__construct() or call add_filter() manually.

It also appears that core does not refresh its own nonces on heartbeat requests outside of the edit-post screen. For example, unless I was doing something wrong, if you mimic the steps in #627 on an edit-term screen, attempting to save the term after reauthenticating will still fail. See https://core.trac.wordpress.org/ticket/29312.

@mslinnea
Copy link
Copy Markdown
Member

mslinnea commented Feb 14, 2021

Hey @dlh01,
I tested this following the steps outlined in #627
This works successfully in WordPress 5.5.2 and WordPress 5.6 for the classic post editor. On the Gutenberg post editor, I was not able to complete the testing steps because clicking on the Gutenberg "save draft" link fails after reauthenticating.
I also updated this PR with master and resolved the merge conflicts.
Looks good to me!

@dlh01
Copy link
Copy Markdown
Member Author

dlh01 commented Feb 16, 2021

Thanks @mslinnea! As we discussed outside of GitHub, the source of the failing nonce appears to be WordPress core (and we'll work on filing a Trac ticket for it soon).

I checked the POST request for saving meta boxes in the block editor, and I confirmed that the refreshed nonces for Fieldmanager are still present. So, once the core bug is fixed, I would expect that this PR will have the desired result in the block editor as well as the classic editor.

Would you mind giving the PR a formal 👍 if everything else seems OK?

mslinnea
mslinnea approved these changes Feb 16, 2021
View reviewed changes
Copy link
Copy Markdown
Member

@mslinnea mslinnea left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! 🐴

@dlh01 dlh01 merged commit ea3eb94 into master Feb 16, 2021
@dlh01 dlh01 deleted the 627-refresh-nonces branch February 16, 2021 14:59
@dlh01 dlh01 mentioned this pull request Feb 16, 2021
Closed
@dlh01 dlh01 added this to the 1.4.0 milestone Jan 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mslinnea mslinnea mslinnea approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

1.4.0

Development

Successfully merging this pull request may close these issues.

2 participants

@dlh01 @mslinnea