vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-06-30 23:30:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Customize: Add changeset locking in Customizer to prevent users from overriding each other's changes.

Browse Source 
* Customization locking is checked when changesets are saved and when heartbeat ticks.
* Lock is lifted immediately upon a user closing the Customizer.
* Heartbeat is introduced into Customizer.
* Changes made to user after it was locked by another user are stored as an autosave revision for restoration.
* Lock notification displays link to preview the other user's changes on the frontend.
* A user loading a locked Customizer changeset will be presented with an option to take over.
* Autosave revisions attached to a published changeset are converted into auto-drafts so that they will be presented to users for restoration.
* Focus constraining is improved in overlay notifications.
* Escape key is stopped from propagating in overlay notifications, and it dismisses dismissible overlay notifications.
* Introduces `changesetLocked` state which is used to disable the Save button and suppress the AYS dialog when leaving the Customizer.
* Fixes bug where users could be presented with each other's autosave revisions.

Props sayedwp, westonruter, melchoyce.
See #31436, #31897, #39896.
Fixes #42024.


git-svn-id: https://develop.svn.wordpress.org/trunk@41839 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Weston Ruter
2017-10-12 04:00:15 +00:00
parent baa8937d58
commit bb63758be8
10 changed files with 677 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

344
src/wp-includes/class-wp-customize-manager.php
View File

@@ -174,7 +174,7 @@ final class WP_Customize_Manager {
protected $messenger_channel;
/**
* Whether the autosave revision of the changeset should should be loaded.
* Whether the autosave revision of the changeset should be loaded.
*
* @since 4.9.0
* @var bool
@@ -373,11 +373,14 @@ final class WP_Customize_Manager {
remove_action( 'admin_init', '_maybe_update_plugins' );
remove_action( 'admin_init', '_maybe_update_themes' );
add_action( 'wp_ajax_customize_save', array( $this, 'save' ) );
add_action( 'wp_ajax_customize_trash', array( $this, 'handle_changeset_trash_request' ) );
add_action( 'wp_ajax_customize_refresh_nonces', array( $this, 'refresh_nonces' ) );
add_action( 'wp_ajax_customize_load_themes', array( $this, 'handle_load_themes_request' ) );
add_action( 'wp_ajax_customize_dismiss_autosave', array( $this, 'handle_dismiss_autosave_request' ) );
add_action( 'wp_ajax_customize_save', array( $this, 'save' ) );
add_action( 'wp_ajax_customize_trash', array( $this, 'handle_changeset_trash_request' ) );
add_action( 'wp_ajax_customize_refresh_nonces', array( $this, 'refresh_nonces' ) );
add_action( 'wp_ajax_customize_load_themes', array( $this, 'handle_load_themes_request' ) );
add_filter( 'heartbeat_settings', array( $this, 'add_customize_screen_to_heartbeat_settings' ) );
add_filter( 'heartbeat_received', array( $this, 'check_changeset_lock_with_heartbeat' ), 10, 3 );
add_action( 'wp_ajax_customize_override_changeset_lock', array( $this, 'handle_override_changeset_lock_request' ) );
add_action( 'wp_ajax_customize_dismiss_autosave_or_lock', array( $this, 'handle_dismiss_autosave_or_lock_request' ) );
add_action( 'customize_register', array( $this, 'register_controls' ) );
add_action( 'customize_register', array( $this, 'register_dynamic_settings' ), 11 ); // allow code to create settings first
@@ -629,6 +632,8 @@ final class WP_Customize_Manager {
$this->_changeset_uuid = $changeset_uuid;
}
$this->set_changeset_lock( $this->changeset_post_id() );
}
/**
@@ -1106,7 +1111,7 @@ final class WP_Customize_Manager {
$this->_changeset_data = array();
} else {
if ( $this->autosaved() ) {
$autosave_post = wp_get_post_autosave( $changeset_post_id );
$autosave_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
if ( $autosave_post ) {
$data = $this->get_changeset_post_data( $autosave_post->ID );
if ( ! is_wp_error( $data ) ) {
@@ -2376,11 +2381,24 @@ final class WP_Customize_Manager {
}
}
$lock_user_id = null;
$autosave = ! empty( $_POST['customize_changeset_autosave'] );
if ( ! $is_new_changeset ) {
$lock_user_id = wp_check_post_lock( $this->changeset_post_id() );
}
// Force request to autosave when changeset is locked.
if ( $lock_user_id && ! $autosave ) {
$autosave = true;
$changeset_status = null;
$changeset_date_gmt = null;
}
if ( $autosave && ! defined( 'DOING_AUTOSAVE' ) ) { // Back-compat.
define( 'DOING_AUTOSAVE', true );
}
$autosaved = false;
$r = $this->save_changeset_post( array(
'status' => $changeset_status,
'title' => $changeset_title,
@@ -2388,6 +2406,21 @@ final class WP_Customize_Manager {
'data' => $input_changeset_data,
'autosave' => $autosave,
) );
if ( $autosave && ! is_wp_error( $r ) ) {
$autosaved = true;
}
// If the changeset was locked and an autosave request wasn't itself an error, then now explicitly return with a failure.
if ( $lock_user_id && ! is_wp_error( $r ) ) {
$r = new WP_Error(
'changeset_locked',
__( 'Changeset is being edited by other user.' ),
array(
'lock_user' => $this->get_lock_user_data( $lock_user_id ),
)
);
}
if ( is_wp_error( $r ) ) {
$response = array(
'message' => $r->get_error_message(),
@@ -2413,6 +2446,10 @@ final class WP_Customize_Manager {
$response['changeset_status'] = 'publish';
}
if ( 'publish' !== $response['changeset_status'] ) {
$this->set_changeset_lock( $changeset_post->ID );
}
if ( 'future' === $response['changeset_status'] ) {
$response['changeset_date'] = $changeset_post->post_date;
}
@@ -2422,6 +2459,10 @@ final class WP_Customize_Manager {
}
}
if ( $autosave ) {
$response['autosaved'] = $autosaved;
}
if ( isset( $response['setting_validities'] ) ) {
$response['setting_validities'] = array_map( array( $this, 'prepare_setting_validity_for_js' ), $response['setting_validities'] );
}
@@ -2684,6 +2725,7 @@ final class WP_Customize_Manager {
array(
'type' => $setting->type,
'user_id' => $args['user_id'],
'date_modified_gmt' => current_time( 'mysql', true ),
)
);
@@ -2798,7 +2840,7 @@ final class WP_Customize_Manager {
$r = wp_update_post( wp_slash( $post_array ), true );
// Delete autosave revision when the changeset is updated.
$autosave_draft = wp_get_post_autosave( $changeset_post_id );
$autosave_draft = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
if ( $autosave_draft ) {
wp_delete_post( $autosave_draft->ID, true );
}
@@ -2989,6 +3031,157 @@ final class WP_Customize_Manager {
return $caps;
}
/**
* Marks the changeset post as being currently edited by the current user.
*
* @since 4.9.0
*
* @param int $changeset_post_id Changeset post id.
* @param bool $take_over Take over the changeset, default is false.
*/
public function set_changeset_lock( $changeset_post_id, $take_over = false ) {
if ( $changeset_post_id ) {
$can_override = ! (bool) get_post_meta( $changeset_post_id, '_edit_lock', true );
if ( $take_over ) {
$can_override = true;
}
if ( $can_override ) {
$lock = sprintf( '%s:%s', time(), get_current_user_id() );
update_post_meta( $changeset_post_id, '_edit_lock', $lock );
} else {
$this->refresh_changeset_lock( $changeset_post_id );
}
}
}
/**
* Refreshes changeset lock with the current time if current user edited the changeset before.
*
* @since 4.9.0
*
* @param int $changeset_post_id Changeset post id.
*/
public function refresh_changeset_lock( $changeset_post_id ) {
if ( ! $changeset_post_id ) {
return;
}
$lock = get_post_meta( $changeset_post_id, '_edit_lock', true );
$lock = explode( ':', $lock );
if ( $lock && ! empty( $lock[1] ) ) {
$user_id = intval( $lock[1] );
$current_user_id = get_current_user_id();
if ( $user_id === $current_user_id ) {
$lock = sprintf( '%s:%s', time(), $user_id );
update_post_meta( $changeset_post_id, '_edit_lock', $lock );
}
}
}
/**
* Filter heartbeat settings for the Customizer.
*
* @since 4.9.0
* @param array $settings Current settings to filter.
* @return array Heartbeat settings.
*/
public function add_customize_screen_to_heartbeat_settings( $settings ) {
global $pagenow;
if ( 'customize.php' === $pagenow ) {
$settings['screenId'] = 'customize';
}
return $settings;
}
/**
* Get lock user data.
*
* @since 4.9.0
*
* @param int $user_id User ID.
* @return array|null User data formatted for client.
*/
protected function get_lock_user_data( $user_id ) {
if ( ! $user_id ) {
return null;
}
$lock_user = get_userdata( $user_id );
if ( ! $lock_user ) {
return null;
}
return array(
'id' => $lock_user->ID,
'name' => $lock_user->display_name,
'avatar' => get_avatar_url( $lock_user->ID, array( 'size' => 128 ) ),
);
}
/**
* Check locked changeset with heartbeat API.
*
* @since 4.9.0
*
* @param array $response The Heartbeat response.
* @param array $data The $_POST data sent.
* @param string $screen_id The screen id.
* @return array The Heartbeat response.
*/
public function check_changeset_lock_with_heartbeat( $response, $data, $screen_id ) {
if ( array_key_exists( 'check_changeset_lock', $data ) && 'customize' === $screen_id && current_user_can( 'customize' ) && $this->changeset_post_id() ) {
$lock_user_id = wp_check_post_lock( $this->changeset_post_id() );
if ( $lock_user_id ) {
$response['customize_changeset_lock_user'] = $this->get_lock_user_data( $lock_user_id );
} else {
// Refreshing time will ensure that the user is sitting on customizer and has not closed the customizer tab.
$this->refresh_changeset_lock( $this->changeset_post_id() );
}
}
return $response;
}
/**
* Removes changeset lock when take over request is sent via Ajax.
*
* @since 4.9.0
*/
public function handle_override_changeset_lock_request() {
if ( ! $this->is_preview() ) {
wp_send_json_error( 'not_preview', 400 );
}
if ( ! check_ajax_referer( 'customize_override_changeset_lock', 'nonce', false ) ) {
wp_send_json_error( array(
'code' => 'invalid_nonce',
'message' => __( 'Security check failed.' ),
) );
}
$changeset_post_id = $this->changeset_post_id();
if ( empty( $changeset_post_id ) ) {
wp_send_json_error( array(
'code' => 'no_changeset_found_to_take_over',
'message' => __( 'No changeset found to take over' ),
) );
}
if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) ) {
wp_send_json_error( array(
'code' => 'cannot_remove_changeset_lock',
'message' => __( 'Sorry you are not allowed to take over.' ),
) );
}
$this->set_changeset_lock( $changeset_post_id, true );
wp_send_json_success( 'changeset_taken_over' );
}
/**
* Whether a changeset revision should be made.
*
@@ -3033,11 +3226,14 @@ final class WP_Customize_Manager {
*
* @since 4.7.0
* @see _wp_customize_publish_changeset()
* @global wpdb $wpdb
*
* @param int $changeset_post_id ID for customize_changeset post. Defaults to the changeset for the current manager instance.
* @return true|WP_Error True or error info.
*/
public function _publish_changeset_values( $changeset_post_id ) {
global $wpdb;
$publishing_changeset_data = $this->get_changeset_post_data( $changeset_post_id );
if ( is_wp_error( $publishing_changeset_data ) ) {
return $publishing_changeset_data;
@@ -3175,6 +3371,30 @@ final class WP_Customize_Manager {
$this->_changeset_post_id = $previous_changeset_post_id;
$this->_changeset_uuid = $previous_changeset_uuid;
/*
* Convert all autosave revisions into their own auto-drafts so that users can be prompted to
* restore them when a changeset is published, but they had been locked out from including
* their changes in the changeset.
*/
$revisions = wp_get_post_revisions( $changeset_post_id, array( 'check_enabled' => false ) );
foreach ( $revisions as $revision ) {
if ( false !== strpos( $revision->post_name, "{$changeset_post_id}-autosave" ) ) {
$wpdb->update(
$wpdb->posts,
array(
'post_status' => 'auto-draft',
'post_type' => 'customize_changeset',
'post_name' => wp_generate_uuid4(),
'post_parent' => 0,
),
array(
'ID' => $revision->ID,
)
);
clean_post_cache( $revision->ID );
}
}
return true;
}
@@ -3229,45 +3449,65 @@ final class WP_Customize_Manager {
}
/**
* Delete a given auto-draft changeset or the autosave revision for a given changeset.
* Delete a given auto-draft changeset or the autosave revision for a given changeset or delete changeset lock.
*
* @since 4.9.0
*/
public function handle_dismiss_autosave_request() {
public function handle_dismiss_autosave_or_lock_request() {
if ( ! $this->is_preview() ) {
wp_send_json_error( 'not_preview', 400 );
}
if ( ! check_ajax_referer( 'customize_dismiss_autosave', 'nonce', false ) ) {
if ( ! check_ajax_referer( 'customize_dismiss_autosave_or_lock', 'nonce', false ) ) {
wp_send_json_error( 'invalid_nonce', 403 );
}
$changeset_post_id = $this->changeset_post_id();
$dismiss_lock = ! empty( $_POST['dismiss_lock'] );
$dismiss_autosave = ! empty( $_POST['dismiss_autosave'] );
if ( empty( $changeset_post_id ) || 'auto-draft' === get_post_status( $changeset_post_id ) ) {
$dismissed = $this->dismiss_user_auto_draft_changesets();
if ( $dismissed > 0 ) {
wp_send_json_success( 'auto_draft_dismissed' );
} else {
wp_send_json_error( 'no_auto_draft_to_delete', 404 );
if ( $dismiss_lock ) {
if ( empty( $changeset_post_id ) && ! $dismiss_autosave ) {
wp_send_json_error( 'no_changeset_to_dismiss_lock', 404 );
}
if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) && ! $dismiss_autosave ) {
wp_send_json_error( 'cannot_remove_changeset_lock', 403 );
}
} else {
$revision = wp_get_post_autosave( $changeset_post_id );
if ( $revision ) {
if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
wp_send_json_error( 'cannot_delete_autosave_revision', 403 );
}
delete_post_meta( $changeset_post_id, '_edit_lock' );
if ( ! wp_delete_post( $revision->ID, true ) ) {
wp_send_json_error( 'autosave_revision_deletion_failure', 500 );
} else {
wp_send_json_success( 'autosave_revision_deleted' );
}
} else {
wp_send_json_error( 'no_autosave_revision_to_delete', 404 );
if ( ! $dismiss_autosave ) {
wp_send_json_success( 'changeset_lock_dismissed' );
}
}
if ( $dismiss_autosave ) {
if ( empty( $changeset_post_id ) || 'auto-draft' === get_post_status( $changeset_post_id ) ) {
$dismissed = $this->dismiss_user_auto_draft_changesets();
if ( $dismissed > 0 ) {
wp_send_json_success( 'auto_draft_dismissed' );
} else {
wp_send_json_error( 'no_auto_draft_to_delete', 404 );
}
} else {
$revision = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
if ( $revision ) {
if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
wp_send_json_error( 'cannot_delete_autosave_revision', 403 );
}
if ( ! wp_delete_post( $revision->ID, true ) ) {
wp_send_json_error( 'autosave_revision_deletion_failure', 500 );
} else {
wp_send_json_success( 'autosave_revision_deleted' );
}
} else {
wp_send_json_error( 'no_autosave_revision_to_delete', 404 );
}
}
}
wp_send_json_error( 'unknown_error', 500 );
}
@@ -3817,6 +4057,39 @@ final class WP_Customize_Manager {
</li>
</script>
<script type="text/html" id="tmpl-customize-changeset-locked-notification">
<li class="notice notice-{{ data.type || 'info' }} {{ data.containerClasses || '' }}" data-code="{{ data.code }}" data-type="{{ data.type }}">
<div class="notification-message customize-changeset-locked-message">
<img class="customize-changeset-locked-avatar" src="{{ data.lockUser.avatar }}" alt="{{ data.lockUser.name }}">
<p class="currently-editing">
<# if ( data.message ) { #>
{{{ data.message }}}
<# } else if ( data.allowOverride ) { #>
<?php
/* translators: %s: User who is customizing the changeset in customizer. */
printf( __( '%s is already customizing this site. Do you want to take over?' ), '{{ data.lockUser.name }}' );
?>
<# } else { #>
<?php
/* translators: %s: User who is customizing the changeset in customizer. */
printf( __( '%s is already customizing this site. Please wait until they are done to try customizing. Your latest changes have been autosaved.' ), '{{ data.lockUser.name }}' );
?>
<# } #>
</p>
<p class="notice notice-error notice-alt" hidden></p>
<p class="action-buttons">
<# if ( data.returnUrl !== data.previewUrl ) { #>
<a class="button customize-notice-go-back-button" href="{{ data.returnUrl }}"><?php _e( 'Go back' ); ?></a>
<# } #>
<a class="button customize-notice-preview-button" href="{{ data.frontendPreviewUrl }}"><?php _e( 'Preview' ); ?></a>
<# if ( data.allowOverride ) { #>
<button class="button button-primary wp-tab-last customize-notice-take-over-button"><?php _e( 'Take over' ); ?></button>
<# } #>
</p>
</div>
</li>
</script>
<?php
/* The following template is obsolete in core but retained for plugins. */
?>
@@ -4188,7 +4461,8 @@ final class WP_Customize_Manager {
'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ),
'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() ),
'switch_themes' => wp_create_nonce( 'switch_themes' ),
'dismiss_autosave' => wp_create_nonce( 'customize_dismiss_autosave' ),
'dismiss_autosave_or_lock' => wp_create_nonce( 'customize_dismiss_autosave_or_lock' ),
'override_lock' => wp_create_nonce( 'customize_override_changeset_lock' ),
'trash' => wp_create_nonce( 'trash_customize_changeset' ),
);
@@ -4231,7 +4505,7 @@ final class WP_Customize_Manager {
$changeset_post_id = $this->changeset_post_id();
if ( ! $this->saved_starter_content_changeset && ! $this->autosaved() ) {
if ( $changeset_post_id ) {
$autosave_revision_post = wp_get_post_autosave( $changeset_post_id );
$autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() );
} else {
$autosave_autodraft_posts = $this->get_changeset_posts( array(
'posts_per_page' => 1,
@@ -4277,6 +4551,11 @@ final class WP_Customize_Manager {
$initial_date = current_time( 'mysql', false );
}
$lock_user_id = false;
if ( $this->changeset_post_id() ) {
$lock_user_id = wp_check_post_lock( $this->changeset_post_id() );
}
$settings = array(
'changeset' => array(
'uuid' => $this->changeset_uuid(),
@@ -4288,6 +4567,7 @@ final class WP_Customize_Manager {
'currentUserCanPublish' => $current_user_can_publish,
'publishDate' => $initial_date,
'statusChoices' => $status_choices,
'lockUser' => $lock_user_id ? $this->get_lock_user_data( $lock_user_id ) : null,
),
'initialServerDate' => current_time( 'mysql', false ),
'dateFormat' => get_option( 'date_format' ),