← All changes | build/pages/dashboard/page.php +47 -8 23.4.0 → trunk View file →

		@@ -87,11 +87,12 @@
87	87	* Automatically called during page rendering.
88	88	*/
89	89	function gutenberg_dashboard_preload_data() {
90	90	// Define paths to preload - same for all pages
91		- // Please also change packages/core-data/src/entities.js when changing this.
	91	+ // This must exactly match the _fields list in packages/core-data/src/entities.js,
	92	+ // same fields in the same order, or the preload is never consumed.
92	93	$preload_paths = array(
93		- '/?_fields=description,gmt_offset,home,image_sizes,image_size_threshold,name,site_icon,site_icon_url,site_logo,timezone_string,url,page_for_posts,page_on_front,show_on_front',
	94	+ '/?_fields=description,gmt_offset,home,image_max_bit_depth,image_sizes,image_size_threshold,image_strip_meta,name,site_icon,site_icon_url,site_logo,timezone_string,url,page_for_posts,page_on_front,show_on_front',
94	95	array( '/wp/v2/settings', 'OPTIONS' ),
95	96	);
96	97
97	98	// Use rest_preload_api_request to gather the preloaded data
		@@ -150,10 +151,14 @@
150	151	// Get all registered routes and menu items
151	152	$menu_items = gutenberg_get_dashboard_menu_items();
152	153	$routes = gutenberg_get_dashboard_routes();
153	154
154		- // Get boot module asset file for dependencies
	155	+ // Get boot module asset file for dependencies. Plugins that build their own
	156	+ // boot module use it; everyone else falls back to the copy bundled with Core.
155	157	$asset_file = __DIR__ . '/../../modules/boot/index.min.asset.php';
	158	+ if ( ! file_exists( $asset_file ) ) {
	159	+ $asset_file = ABSPATH . WPINC . '/js/dist/script-modules/boot/index.min.asset.php';
	160	+ }
156	161	if ( file_exists( $asset_file ) ) {
157	162	$asset = require $asset_file;
158	163
159	164	// This script serves two purposes:
		@@ -161,9 +166,9 @@
161	166	// 2. It initializes the boot module as an inline script.
162	167	wp_register_script( 'dashboard-prerequisites', '', $asset['dependencies'], $asset['version'], true );
163	168
164	169	// Add inline script to initialize the app
165		- $init_modules = [];
	170	+ $init_modules = ["@wordpress/dashboard-init"];
166	171	wp_add_inline_script(
167	172	'dashboard-prerequisites',
168	173	sprintf(
169	174	'import("@wordpress/boot").then(mod => mod.init({mountId: "%s", menuItems: %s, routes: %s, initModules: %s, dashboardLink: "%s"}));',
		@@ -192,9 +197,9 @@
192	197	),
193	198	);
194	199
195	200	// Add init modules as static dependencies
196		- // No init modules configured
	201	+ $boot_dependencies[] = array( 'import' => 'static', 'id' => '@wordpress/dashboard-init' );
197	202
198	203	// Add all registered routes as dependencies
199	204	foreach ( $routes as $route ) {
200	205	if ( isset( $route['route_module'] ) ) {
		@@ -250,9 +255,9 @@
250	255	<style>
251	256	html {
252	257	background: #f1f1f1;
253	258	color: #444;
254		- font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
	259	+ font-family: -apple-system, system-ui, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
255	260	font-size: 13px;
256	261	line-height: 1.4em;
257	262	}
258	263	body {
		@@ -276,15 +281,33 @@
276	281	do_action( 'admin_head' );
277	282	// END see wp-admin/admin-header.php
278	283	?>
279	284	</head>
280		- <body class="dashboard">
	285	+ <body class="dashboard no-js">
	286	+ <?php
	287	+ // BEGIN see wp-admin/admin-header.php
	288	+ ?>
	289	+ <script type="text/javascript">
	290	+ document.body.className = document.body.className.replace( 'no-js', 'js' );
	291	+ </script>
	292	+ <?php
	293	+ // END see wp-admin/admin-header.php
	294	+ ?>
	295	+ <div class="wrap hide-if-js" style="margin: 20px;">
	296	+ <h1 class="wp-heading-inline"><?php echo esc_html( get_admin_page_title() ); ?></h1>
	297	+ <?php
	298	+ wp_admin_notice(
	299	+ __( 'This screen requires JavaScript. Enable JavaScript in your browser settings and reload the page.' ),
	300	+ array( 'type' => 'error' )
	301	+ );
	302	+ ?>
	303	+ </div>
281	304	<div id="dashboard-app" style="height: 100vh; box-sizing: border-box;"></div>
282	305	<?php
283	306	// BEGIN see wp-admin/admin-footer.php
284	307
285	308	/** This action is documented in wp-admin/admin-footer.php */
286		- do_action( 'admin_footer', '' );
	309	+ do_action( 'admin_footer', $hook_suffix );
287	310
288	311	// Print import map first so it's available for inline scripts
289	312	wp_script_modules()->print_import_map();
290	313	print_footer_scripts();
		@@ -308,8 +331,24 @@
308	331	*/
309	332	function gutenberg_dashboard_intercept_render() {
310	333	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
311	334	if ( isset( $_GET['page'] ) && 'dashboard' === $_GET['page'] ) {
	335	+ // The page renders outside the menu page callback flow, so it must
	336	+ // enforce authentication and capability checks itself. Without this,
	337	+ // any admin entry point firing `admin_init` (such as admin-post.php,
	338	+ // which serves logged-out requests) would render the page for
	339	+ // unauthenticated visitors.
	340	+ if ( ! is_user_logged_in() ) {
	341	+ auth_redirect();
	342	+ }
	343	+
	344	+ if ( ! current_user_can( 'manage_options' ) ) {
	345	+ wp_die(
	346	+ __( 'Sorry, you are not allowed to access this page.' ),
	347	+ 403
	348	+ );
	349	+ }
	350	+
312	351	gutenberg_dashboard_render_page();
313	352	exit;
314	353	}
315	354	}