Skip to content

Commit ed064bb

Browse files
westonruterwestonruter
committed
Add initial Test_WP_Customize_Selective_Refresh_Ajax; use is_customize_preview() for auth check
1 parent c5a351d commit ed064bb

File tree

3 files changed

+146
-13
lines changed

3 files changed

+146
-13
lines changed

‎php/class-wp-customize-selective-refresh.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -479,10 +479,12 @@ public function handle_render_partials_request() {
479479

480480
$this->manager->remove_preview_signature();
481481

482-
if ( ! check_ajax_referer( 'preview-customize_' . $this->manager->get_stylesheet(), 'nonce', false ) ) {
483-
status_header( 403 );
484-
wp_send_json_error( 'nonce_check_fail' );
485-
} else if ( ! current_user_can( 'customize' ) || ! is_customize_preview() ) {
482+
/*
483+
* Note that is_customize_preview() returning true will entail that the
484+
* user passed the 'customize' capability check and the nonce check, since
485+
* WP_Customize_Manager::setup_theme() is where the previewing flag is set.
486+
*/
487+
if ( ! is_customize_preview() ) {
486488
status_header( 403 );
487489
wp_send_json_error( 'expected_customize_preview' );
488490
} else if ( ! isset( $_POST['partials'] ) ) {

‎tests/php/test-class-wp-customize-selective-refresh-ajax.php‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
<?php
2+
/**
3+
* WP_Customize_Selective_Refresh Ajax tests.
4+
*
5+
* @package WordPress
6+
* @subpackage UnitTests
7+
* @since 4.5.0
8+
* @group ajax
9+
*/
10+
11+
/**
12+
* Tests for the WP_Customize_Selective_Refresh class Ajax.
13+
*
14+
* Note that this is intentionally not extending WP_Ajax_UnitTestCase because it
15+
* is not admin ajax.
16+
*/
17+
class Test_WP_Customize_Selective_Refresh_Ajax extends WP_UnitTestCase {
18+
19+
/**
20+
* Manager.
21+
*
22+
* @var WP_Customize_Manager
23+
*/
24+
public $wp_customize;
25+
26+
/**
27+
* Component.
28+
*
29+
* @var WP_Customize_Selective_Refresh
30+
*/
31+
public $selective_refresh;
32+
33+
/**
34+
* Set up the test fixture.
35+
*/
36+
function setUp() {
37+
parent::setUp();
38+
39+
// Define DOING_AJAX so that wp_die() will be used instead of die().
40+
if ( ! defined( 'DOING_AJAX' ) ) {
41+
define( 'DOING_AJAX', true );
42+
}
43+
add_filter( 'wp_die_ajax_handler', array( $this, 'get_wp_die_handler' ), 1, 1 );
44+
45+
require_once( ABSPATH . WPINC . '/class-wp-customize-manager.php' );
46+
// @codingStandardsIgnoreStart
47+
$GLOBALS['wp_customize'] = new WP_Customize_Manager();
48+
// @codingStandardsIgnoreEnd
49+
$this->wp_customize = $GLOBALS['wp_customize'];
50+
if ( isset( $this->wp_customize->selective_refresh ) ) {
51+
$this->selective_refresh = $this->wp_customize->selective_refresh;
52+
}
53+
54+
}
55+
56+
/**
57+
* Do Customizer boot actions.
58+
*/
59+
function do_customize_boot_actions() {
60+
// Remove actions that call add_theme_support( 'title-tag' ).
61+
remove_action( 'after_setup_theme', 'twentyfifteen_setup' );
62+
remove_action( 'after_setup_theme', 'twentysixteen_setup' );
63+
64+
$_SERVER['REQUEST_METHOD'] = 'POST';
65+
do_action( 'setup_theme' );
66+
do_action( 'after_setup_theme' );
67+
do_action( 'init' );
68+
do_action( 'customize_register', $this->wp_customize );
69+
$this->wp_customize->customize_preview_init();
70+
do_action( 'wp', $GLOBALS['wp'] );
71+
}
72+
73+
/**
74+
* Test WP_Customize_Selective_Refresh::handle_render_partials_request().
75+
*
76+
* @see WP_Customize_Selective_Refresh::handle_render_partials_request()
77+
*/
78+
function test_handle_render_partials_request_for_unauthenticated_user() {
79+
$_POST[ WP_Customize_Selective_Refresh::RENDER_QUERY_VAR ] = '1';
80+
81+
// Check current_user_cannot_customize.
82+
ob_start();
83+
try {
84+
$this->selective_refresh->handle_render_partials_request();
85+
} catch ( WPDieException $e ) {
86+
unset( $e );
87+
}
88+
$output = json_decode( ob_get_clean(), true );
89+
$this->assertFalse( $output['success'] );
90+
$this->assertEquals( 'expected_customize_preview', $output['data'] );
91+
92+
// Check expected_customize_preview.
93+
wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
94+
$_REQUEST['nonce'] = wp_create_nonce( 'preview-customize_' . $this->wp_customize->theme()->get_stylesheet() );
95+
ob_start();
96+
try {
97+
$this->selective_refresh->handle_render_partials_request();
98+
} catch ( WPDieException $e ) {
99+
unset( $e );
100+
}
101+
$output = json_decode( ob_get_clean(), true );
102+
$this->assertFalse( $output['success'] );
103+
$this->assertEquals( 'expected_customize_preview', $output['data'] );
104+
105+
// Check missing_partials.
106+
$this->do_customize_boot_actions();
107+
ob_start();
108+
try {
109+
$this->selective_refresh->handle_render_partials_request();
110+
} catch ( WPDieException $e ) {
111+
unset( $e );
112+
}
113+
$output = json_decode( ob_get_clean(), true );
114+
$this->assertFalse( $output['success'] );
115+
$this->assertEquals( 'missing_partials', $output['data'] );
116+
117+
// Check missing_partials.
118+
$_POST['partials'] = 'bad';
119+
$this->do_customize_boot_actions();
120+
ob_start();
121+
try {
122+
$this->selective_refresh->handle_render_partials_request();
123+
} catch ( WPDieException $e ) {
124+
unset( $e );
125+
}
126+
$output = json_decode( ob_get_clean(), true );
127+
$this->assertFalse( $output['success'] );
128+
$this->assertEquals( 'malformed_partials', $output['data'] );
129+
}
130+
131+
/**
132+
* Tear down.
133+
*/
134+
function tearDown() {
135+
$this->wp_customize = null;
136+
unset( $GLOBALS['wp_customize'] );
137+
unset( $GLOBALS['wp_scripts'] );
138+
parent::tearDown();
139+
}
140+
}

‎tests/php/test-class-wp-customize-selective-refresh.php‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -276,15 +276,6 @@ function test_is_render_partials_request() {
276276
$this->assertTrue( $this->selective_refresh->is_render_partials_request() );
277277
}
278278

279-
/**
280-
* Test WP_Customize_Selective_Refresh::handle_render_partials_request().
281-
*
282-
* @see WP_Customize_Selective_Refresh::handle_render_partials_request()
283-
*/
284-
function test_handle_render_partials_request() {
285-
$this->markTestIncomplete();
286-
}
287-
288279
/**
289280
* Tear down.
290281
*/

0 commit comments

Comments
 (0)