class.frame-nonce-preview.php — Jetpack – WP Security, Backup, Speed, & Growth 7.2.1

jetpack / class.frame-nonce-preview.php

jetpack Last commit date

class.frame-nonce-preview.php

120 lines

1	<?php
2
3	/**
4	* Allows viewing posts on the frontend when the user is not logged in.
5	*/
6	class Jetpack_Frame_Nonce_Preview {
7	static $instance = null;
8
9	/**
10	* Returns the single instance of the Jetpack_Frame_Nonce_Preview object
11	*
12	* @since 4.3.0
13	*
14	* @return Jetpack_Frame_Nonce_Preview
15	**/
16	public static function get_instance() {
17	if ( ! is_null( self::$instance ) ) {
18	return self::$instance;
19	}
20
21	return self::$instance = new Jetpack_Frame_Nonce_Preview();
22	}
23
24	function __construct() {
25	if ( isset( $_GET['frame-nonce'] ) && ! is_admin() ) {
26	add_filter( 'pre_get_posts', array( $this, 'maybe_display_post' ) );
27	}
28
29	// autosave previews are validated differently
30	if ( isset( $_GET[ 'frame-nonce' ] ) && isset( $_GET[ 'preview_id' ] ) && isset( $_GET[ 'preview_nonce' ] ) ) {
31	remove_action( 'init', '_show_post_preview' );
32	add_action( 'init', array( $this, 'handle_autosave_nonce_validation' ) );
33	}
34	}
35
36	/**
37	* Verify that frame nonce exists, and if so, validate the nonce by calling WP.com.
38	*
39	* @since 4.3.0
40	*
41	* @return bool
42	*/
43	public function is_frame_nonce_valid() {
44	if ( empty( $_GET[ 'frame-nonce' ] ) ) {
45	return false;
46	}
47
48	Jetpack::load_xml_rpc_client();
49	$xml = new Jetpack_IXR_Client();
50	$xml->query( 'jetpack.verifyFrameNonce', sanitize_key( $_GET['frame-nonce'] ) );
51
52	if ( $xml->isError() ) {
53	return false;
54	}
55
56	return (bool) $xml->getResponse();
57	}
58
59	/**
60	* Conditionally add a hook on posts_results if this is the main query, a preview, and singular.
61	*
62	* @since 4.3.0
63	*
64	* @param WP_Query $query
65	*
66	* @return WP_Query
67	*/
68	public function maybe_display_post( $query ) {
69	if (
70	$query->is_main_query() &&
71	$query->is_preview() &&
72	$query->is_singular()
73	) {
74	add_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10, 2 );
75	}
76
77	return $query;
78	}
79
80	/**
81	* Conditionally set the first post to 'publish' if the frame nonce is valid and there is a post.
82	*
83	* @since 4.3.0
84	*
85	* @param array $posts
86	*
87	* @return array
88	*/
89	public function set_post_to_publish( $posts ) {
90	remove_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10, 2 );
91
92	if ( empty( $posts ) \|\| is_user_logged_in() \|\| ! $this->is_frame_nonce_valid() ) {
93	return $posts;
94	}
95
96	$posts[0]->post_status = 'publish';
97
98	// Disable comments and pings for this post.
99	add_filter( 'comments_open', '__return_false' );
100	add_filter( 'pings_open', '__return_false' );
101
102	return $posts;
103	}
104
105	/**
106	* Handle validation for autosave preview request
107	*
108	* @since 4.7.0
109	*
110	*/
111	public function handle_autosave_nonce_validation() {
112	if ( ! $this->is_frame_nonce_valid() ) {
113	wp_die( __( 'Sorry, you are not allowed to preview drafts.', 'jetpack' ) );
114	}
115	add_filter( 'the_preview', '_set_preview' );
116	}
117	}
118
119	Jetpack_Frame_Nonce_Preview::get_instance();
120