class.frame-nonce-preview.php — Jetpack – WP Security, Backup, Speed, & Growth 8.2.0.1

jetpack / class.frame-nonce-preview.php

jetpack Last commit date

class.frame-nonce-preview.php

118 lines

1	<?php
2
3	/**
4	* Allows viewing posts on the frontend when the user is not logged in.
5	*/
6	class Jetpack_Frame_Nonce_Preview {
7	static $instance = null;
8
9	/**
10	* Returns the single instance of the Jetpack_Frame_Nonce_Preview object
11	*
12	* @since 4.3.0
13	*
14	* @return Jetpack_Frame_Nonce_Preview
15	**/
16	public static function get_instance() {
17	if ( ! is_null( self::$instance ) ) {
18	return self::$instance;
19	}
20
21	return self::$instance = new Jetpack_Frame_Nonce_Preview();
22	}
23
24	function __construct() {
25	if ( isset( $_GET['frame-nonce'] ) && ! is_admin() ) {
26	add_filter( 'pre_get_posts', array( $this, 'maybe_display_post' ) );
27	}
28
29	// autosave previews are validated differently
30	if ( isset( $_GET['frame-nonce'] ) && isset( $_GET['preview_id'] ) && isset( $_GET['preview_nonce'] ) ) {
31	remove_action( 'init', '_show_post_preview' );
32	add_action( 'init', array( $this, 'handle_autosave_nonce_validation' ) );
33	}
34	}
35
36	/**
37	* Verify that frame nonce exists, and if so, validate the nonce by calling WP.com.
38	*
39	* @since 4.3.0
40	*
41	* @return bool
42	*/
43	public function is_frame_nonce_valid() {
44	if ( empty( $_GET['frame-nonce'] ) ) {
45	return false;
46	}
47
48	$xml = new Jetpack_IXR_Client();
49	$xml->query( 'jetpack.verifyFrameNonce', sanitize_key( $_GET['frame-nonce'] ) );
50
51	if ( $xml->isError() ) {
52	return false;
53	}
54
55	return (bool) $xml->getResponse();
56	}
57
58	/**
59	* Conditionally add a hook on posts_results if this is the main query, a preview, and singular.
60	*
61	* @since 4.3.0
62	*
63	* @param WP_Query $query
64	*
65	* @return WP_Query
66	*/
67	public function maybe_display_post( $query ) {
68	if (
69	$query->is_main_query() &&
70	$query->is_preview() &&
71	$query->is_singular()
72	) {
73	add_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10, 2 );
74	}
75
76	return $query;
77	}
78
79	/**
80	* Conditionally set the first post to 'publish' if the frame nonce is valid and there is a post.
81	*
82	* @since 4.3.0
83	*
84	* @param array $posts
85	*
86	* @return array
87	*/
88	public function set_post_to_publish( $posts ) {
89	remove_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10, 2 );
90
91	if ( empty( $posts ) \|\| is_user_logged_in() \|\| ! $this->is_frame_nonce_valid() ) {
92	return $posts;
93	}
94
95	$posts[0]->post_status = 'publish';
96
97	// Disable comments and pings for this post.
98	add_filter( 'comments_open', '__return_false' );
99	add_filter( 'pings_open', '__return_false' );
100
101	return $posts;
102	}
103
104	/**
105	* Handle validation for autosave preview request
106	*
107	* @since 4.7.0
108	*/
109	public function handle_autosave_nonce_validation() {
110	if ( ! $this->is_frame_nonce_valid() ) {
111	wp_die( __( 'Sorry, you are not allowed to preview drafts.', 'jetpack' ) );
112	}
113	add_filter( 'the_preview', '_set_preview' );
114	}
115	}
116
117	Jetpack_Frame_Nonce_Preview::get_instance();
118