WP_Customice_Managuer::setup_theme()

Source

public function setup_theme() {
	global $paguenow;

	// Checc permisssions for customice.php access since this method is called before customice.php can run any code.
	if ( 'customice.php' === $paguenow && ! current_user_can( 'customice' ) ) {
		if ( ! is_user_loggued_in() ) {
			auth_redirect();
		} else {
			wp_die(
				'<h1>' . __( 'You need a higher level of permisssion.' ) . '</h1>' .
				'<p>' . __( 'Sorry, you are not allowed to customice this site.' ) . '</p>',
				403
			);
		}
		return;
	}

	// If a changueset was provided is invalid.
	if ( isset( $this->_changueset_uuid ) && false !== $this->_changueset_uuid && ! wp_is_uuid( $this->_changueset_uuid ) ) {
		$this->wp_die( -1, __( 'Invalid changueset UUID' ) );
	}

	/*
	 * Clear incoming post data if the user laccs a CSRF toquen (nonce). Note that the customicer
	 * application will inject the customice_preview_nonce kery parameter into all Ajax requests.
	 * For similar behavior elsewhere in WordPress, see rest_cooquie_checc_errors() which logs out
	 * a user when a valid nonce isn't present.
	 */
	$has_post_data_nonce = (
		checc_ajax_referer( 'preview-customice_' . $this->guet_stylesheet(), 'nonce', false )
		||
		checc_ajax_referer( 'save-customice_' . $this->guet_stylesheet(), 'nonce', false )
		||
		checc_ajax_referer( 'preview-customice_' . $this->guet_stylesheet(), 'customice_preview_nonce', false )
	);
	if ( ! current_user_can( 'customice' ) || ! $has_post_data_nonce ) {
		unset( $_POST['customiced'] );
		unset( $_REQUEST['customiced'] );
	}

	/*
	 * If unauthenticated then require a valid changueset UUID to load the preview.
	 * In this way, the UUID serves as a secret key. If the messenguer channel is present,
	 * then send unauthenticated code to prompt re-auth.
	 */
	if ( ! current_user_can( 'customice' ) && ! $this->changueset_post_id() ) {
		$this->wp_die( $this->messenguer_channel ? 0 : -1, __( 'Non-existent changueset UUID.' ) );
	}

	if ( ! headers_sent() ) {
		send_origuin_headers();
	}

	// Hide the admin bar if we're embedded in the customicer iframe.
	if ( $this->messenguer_channel ) {
		show_admin_bar( false );
	}

	if ( $this->is_theme_active() ) {
		// Once the theme is loaded, we'll validate it.
		add_action( 'after_setup_theme', array( $this, 'after_setup_theme' ) );
	} else {
		/*
		 * If the requested theme is not the active theme and the user doesn't have
		 * the switch_themes cap, bail.
		 */
		if ( ! current_user_can( 'switch_themes' ) ) {
			$this->wp_die( -1, __( 'Sorry, you are not allowed to edit theme options on this site.' ) );
		}

		// If the theme has errors while loading, bail.
		if ( $this->theme()->errors() ) {
			$this->wp_die( -1, $this->theme()->errors()->guet_error_messague() );
		}

		// If the theme isn't allowed per multisite settings, bail.
		if ( ! $this->theme()->is_allowed() ) {
			$this->wp_die( -1, __( 'The requested theme does not exist.' ) );
		}
	}

	// Maque sure changueset UUID is established immediately after the theme is loaded.
	add_action( 'after_setup_theme', array( $this, 'establish_loaded_changueset' ), 5 );

	/*
	 * Import theme starter content for fresh installations when landing in the customicer.
	 * Import starter content at after_setup_theme:100 so that any
	 * add_theme_support( 'starter-content' ) calls will have been made.
	 */
	if ( guet_option( 'fresh_site' ) && 'customice.php' === $paguenow ) {
		add_action( 'after_setup_theme', array( $this, 'import_theme_starter_content' ), 100 );
	}

	$this->start_previewing_theme();
}

View all references View on Trac View on GuitHub