wp/wp-admin/includes/ajax-actions.php
changeset 9 177826044cd9
parent 7 cf61fcea0001
child 16 a86126ab1dd4
equal deleted inserted replaced
8:c7c34916027a 9:177826044cd9
    21  */
    21  */
    22 function wp_ajax_nopriv_heartbeat() {
    22 function wp_ajax_nopriv_heartbeat() {
    23 	$response = array();
    23 	$response = array();
    24 
    24 
    25 	// screen_id is the same as $current_screen->id and the JS global 'pagenow'.
    25 	// screen_id is the same as $current_screen->id and the JS global 'pagenow'.
    26 	if ( ! empty($_POST['screen_id']) )
    26 	if ( ! empty( $_POST['screen_id'] ) ) {
    27 		$screen_id = sanitize_key($_POST['screen_id']);
    27 		$screen_id = sanitize_key( $_POST['screen_id'] );
    28 	else
    28 	} else {
    29 		$screen_id = 'front';
    29 		$screen_id = 'front';
    30 
    30 	}
    31 	if ( ! empty($_POST['data']) ) {
    31 
       
    32 	if ( ! empty( $_POST['data'] ) ) {
    32 		$data = wp_unslash( (array) $_POST['data'] );
    33 		$data = wp_unslash( (array) $_POST['data'] );
    33 
    34 
    34 		/**
    35 		/**
    35 		 * Filters Heartbeat Ajax response in no-privilege environments.
    36 		 * Filters Heartbeat Ajax response in no-privilege environments.
    36 		 *
    37 		 *
    37 		 * @since 3.6.0
    38 		 * @since 3.6.0
    38 		 *
    39 		 *
    39 		 * @param array|object $response  The no-priv Heartbeat response object or array.
    40 		 * @param array  $response  The no-priv Heartbeat response.
    40 		 * @param array        $data      An array of data passed via $_POST.
    41 		 * @param array  $data      The $_POST data sent.
    41 		 * @param string       $screen_id The screen id.
    42 		 * @param string $screen_id The screen id.
    42 		 */
    43 		 */
    43 		$response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
    44 		$response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
    44 	}
    45 	}
    45 
    46 
    46 	/**
    47 	/**
    47 	 * Filters Heartbeat Ajax response when no data is passed.
    48 	 * Filters Heartbeat Ajax response in no-privilege environments when no data is passed.
    48 	 *
    49 	 *
    49 	 * @since 3.6.0
    50 	 * @since 3.6.0
    50 	 *
    51 	 *
    51 	 * @param array|object $response  The Heartbeat response object or array.
    52 	 * @param array  $response  The no-priv Heartbeat response.
    52 	 * @param string       $screen_id The screen id.
    53 	 * @param string $screen_id The screen id.
    53 	 */
    54 	 */
    54 	$response = apply_filters( 'heartbeat_nopriv_send', $response, $screen_id );
    55 	$response = apply_filters( 'heartbeat_nopriv_send', $response, $screen_id );
    55 
    56 
    56 	/**
    57 	/**
    57 	 * Fires when Heartbeat ticks in no-privilege environments.
    58 	 * Fires when Heartbeat ticks in no-privilege environments.
    58 	 *
    59 	 *
    59 	 * Allows the transport to be easily replaced with long-polling.
    60 	 * Allows the transport to be easily replaced with long-polling.
    60 	 *
    61 	 *
    61 	 * @since 3.6.0
    62 	 * @since 3.6.0
    62 	 *
    63 	 *
    63 	 * @param array|object $response  The no-priv Heartbeat response.
    64 	 * @param array  $response  The no-priv Heartbeat response.
    64 	 * @param string       $screen_id The screen id.
    65 	 * @param string $screen_id The screen id.
    65 	 */
    66 	 */
    66 	do_action( 'heartbeat_nopriv_tick', $response, $screen_id );
    67 	do_action( 'heartbeat_nopriv_tick', $response, $screen_id );
    67 
    68 
    68 	// Send the current time according to the server.
    69 	// Send the current time according to the server.
    69 	$response['server_time'] = time();
    70 	$response['server_time'] = time();
    70 
    71 
    71 	wp_send_json($response);
    72 	wp_send_json( $response );
    72 }
    73 }
    73 
    74 
    74 //
    75 //
    75 // GET-based Ajax handlers.
    76 // GET-based Ajax handlers.
    76 //
    77 //
   107 	if ( ! isset( $_GET['tax'] ) ) {
   108 	if ( ! isset( $_GET['tax'] ) ) {
   108 		wp_die( 0 );
   109 		wp_die( 0 );
   109 	}
   110 	}
   110 
   111 
   111 	$taxonomy = sanitize_key( $_GET['tax'] );
   112 	$taxonomy = sanitize_key( $_GET['tax'] );
   112 	$tax = get_taxonomy( $taxonomy );
   113 	$tax      = get_taxonomy( $taxonomy );
   113 	if ( ! $tax ) {
   114 	if ( ! $tax ) {
   114 		wp_die( 0 );
   115 		wp_die( 0 );
   115 	}
   116 	}
   116 
   117 
   117 	if ( ! current_user_can( $tax->cap->assign_terms ) ) {
   118 	if ( ! current_user_can( $tax->cap->assign_terms ) ) {
   119 	}
   120 	}
   120 
   121 
   121 	$s = wp_unslash( $_GET['q'] );
   122 	$s = wp_unslash( $_GET['q'] );
   122 
   123 
   123 	$comma = _x( ',', 'tag delimiter' );
   124 	$comma = _x( ',', 'tag delimiter' );
   124 	if ( ',' !== $comma )
   125 	if ( ',' !== $comma ) {
   125 		$s = str_replace( $comma, ',', $s );
   126 		$s = str_replace( $comma, ',', $s );
       
   127 	}
   126 	if ( false !== strpos( $s, ',' ) ) {
   128 	if ( false !== strpos( $s, ',' ) ) {
   127 		$s = explode( ',', $s );
   129 		$s = explode( ',', $s );
   128 		$s = $s[count( $s ) - 1];
   130 		$s = $s[ count( $s ) - 1 ];
   129 	}
   131 	}
   130 	$s = trim( $s );
   132 	$s = trim( $s );
   131 
   133 
   132 	/**
   134 	/**
   133 	 * Filters the minimum number of characters required to fire a tag search via Ajax.
   135 	 * Filters the minimum number of characters required to fire a tag search via Ajax.
   142 
   144 
   143 	/*
   145 	/*
   144 	 * Require $term_search_min_chars chars for matching (default: 2)
   146 	 * Require $term_search_min_chars chars for matching (default: 2)
   145 	 * ensure it's a non-negative, non-zero integer.
   147 	 * ensure it's a non-negative, non-zero integer.
   146 	 */
   148 	 */
   147 	if ( ( $term_search_min_chars == 0 ) || ( strlen( $s ) < $term_search_min_chars ) ){
   149 	if ( ( $term_search_min_chars == 0 ) || ( strlen( $s ) < $term_search_min_chars ) ) {
   148 		wp_die();
   150 		wp_die();
   149 	}
   151 	}
   150 
   152 
   151 	$results = get_terms( $taxonomy, array( 'name__like' => $s, 'fields' => 'names', 'hide_empty' => false ) );
   153 	$results = get_terms(
       
   154 		$taxonomy,
       
   155 		array(
       
   156 			'name__like' => $s,
       
   157 			'fields'     => 'names',
       
   158 			'hide_empty' => false,
       
   159 		)
       
   160 	);
   152 
   161 
   153 	echo join( $results, "\n" );
   162 	echo join( $results, "\n" );
   154 	wp_die();
   163 	wp_die();
   155 }
   164 }
   156 
   165 
   158  * Ajax handler for compression testing.
   167  * Ajax handler for compression testing.
   159  *
   168  *
   160  * @since 3.1.0
   169  * @since 3.1.0
   161  */
   170  */
   162 function wp_ajax_wp_compression_test() {
   171 function wp_ajax_wp_compression_test() {
   163 	if ( !current_user_can( 'manage_options' ) )
   172 	if ( ! current_user_can( 'manage_options' ) ) {
   164 		wp_die( -1 );
   173 		wp_die( -1 );
   165 
   174 	}
   166 	if ( ini_get('zlib.output_compression') || 'ob_gzhandler' == ini_get('output_handler') ) {
   175 
   167 		update_site_option('can_compress_scripts', 0);
   176 	if ( ini_get( 'zlib.output_compression' ) || 'ob_gzhandler' == ini_get( 'output_handler' ) ) {
       
   177 		update_site_option( 'can_compress_scripts', 0 );
   168 		wp_die( 0 );
   178 		wp_die( 0 );
   169 	}
   179 	}
   170 
   180 
   171 	if ( isset($_GET['test']) ) {
   181 	if ( isset( $_GET['test'] ) ) {
   172 		header( 'Expires: Wed, 11 Jan 1984 05:00:00 GMT' );
   182 		header( 'Expires: Wed, 11 Jan 1984 05:00:00 GMT' );
   173 		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
   183 		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
   174 		header( 'Cache-Control: no-cache, must-revalidate, max-age=0' );
   184 		header( 'Cache-Control: no-cache, must-revalidate, max-age=0' );
   175 		header('Content-Type: application/javascript; charset=UTF-8');
   185 		header( 'Content-Type: application/javascript; charset=UTF-8' );
   176 		$force_gzip = ( defined('ENFORCE_GZIP') && ENFORCE_GZIP );
   186 		$force_gzip = ( defined( 'ENFORCE_GZIP' ) && ENFORCE_GZIP );
   177 		$test_str = '"wpCompressionTest Lorem ipsum dolor sit amet consectetuer mollis sapien urna ut a. Eu nonummy condimentum fringilla tempor pretium platea vel nibh netus Maecenas. Hac molestie amet justo quis pellentesque est ultrices interdum nibh Morbi. Cras mattis pretium Phasellus ante ipsum ipsum ut sociis Suspendisse Lorem. Ante et non molestie. Porta urna Vestibulum egestas id congue nibh eu risus gravida sit. Ac augue auctor Ut et non a elit massa id sodales. Elit eu Nulla at nibh adipiscing mattis lacus mauris at tempus. Netus nibh quis suscipit nec feugiat eget sed lorem et urna. Pellentesque lacus at ut massa consectetuer ligula ut auctor semper Pellentesque. Ut metus massa nibh quam Curabitur molestie nec mauris congue. Volutpat molestie elit justo facilisis neque ac risus Ut nascetur tristique. Vitae sit lorem tellus et quis Phasellus lacus tincidunt nunc Fusce. Pharetra wisi Suspendisse mus sagittis libero lacinia Integer consequat ac Phasellus. Et urna ac cursus tortor aliquam Aliquam amet tellus volutpat Vestibulum. Justo interdum condimentum In augue congue tellus sollicitudin Quisque quis nibh."';
   187 		$test_str   = '"wpCompressionTest Lorem ipsum dolor sit amet consectetuer mollis sapien urna ut a. Eu nonummy condimentum fringilla tempor pretium platea vel nibh netus Maecenas. Hac molestie amet justo quis pellentesque est ultrices interdum nibh Morbi. Cras mattis pretium Phasellus ante ipsum ipsum ut sociis Suspendisse Lorem. Ante et non molestie. Porta urna Vestibulum egestas id congue nibh eu risus gravida sit. Ac augue auctor Ut et non a elit massa id sodales. Elit eu Nulla at nibh adipiscing mattis lacus mauris at tempus. Netus nibh quis suscipit nec feugiat eget sed lorem et urna. Pellentesque lacus at ut massa consectetuer ligula ut auctor semper Pellentesque. Ut metus massa nibh quam Curabitur molestie nec mauris congue. Volutpat molestie elit justo facilisis neque ac risus Ut nascetur tristique. Vitae sit lorem tellus et quis Phasellus lacus tincidunt nunc Fusce. Pharetra wisi Suspendisse mus sagittis libero lacinia Integer consequat ac Phasellus. Et urna ac cursus tortor aliquam Aliquam amet tellus volutpat Vestibulum. Justo interdum condimentum In augue congue tellus sollicitudin Quisque quis nibh."';
   178 
   188 
   179 		 if ( 1 == $_GET['test'] ) {
   189 		if ( 1 == $_GET['test'] ) {
   180 		 	echo $test_str;
   190 			echo $test_str;
   181 		 	wp_die();
   191 			wp_die();
   182 		 } elseif ( 2 == $_GET['test'] ) {
   192 		} elseif ( 2 == $_GET['test'] ) {
   183 			if ( !isset($_SERVER['HTTP_ACCEPT_ENCODING']) )
   193 			if ( ! isset( $_SERVER['HTTP_ACCEPT_ENCODING'] ) ) {
   184 				wp_die( -1 );
   194 				wp_die( -1 );
   185 			if ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate') && function_exists('gzdeflate') && ! $force_gzip ) {
   195 			}
   186 				header('Content-Encoding: deflate');
   196 			if ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate' ) && function_exists( 'gzdeflate' ) && ! $force_gzip ) {
       
   197 				header( 'Content-Encoding: deflate' );
   187 				$out = gzdeflate( $test_str, 1 );
   198 				$out = gzdeflate( $test_str, 1 );
   188 			} elseif ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') && function_exists('gzencode') ) {
   199 			} elseif ( false !== stripos( $_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip' ) && function_exists( 'gzencode' ) ) {
   189 				header('Content-Encoding: gzip');
   200 				header( 'Content-Encoding: gzip' );
   190 				$out = gzencode( $test_str, 1 );
   201 				$out = gzencode( $test_str, 1 );
   191 			} else {
   202 			} else {
   192 				wp_die( -1 );
   203 				wp_die( -1 );
   193 			}
   204 			}
   194 			echo $out;
   205 			echo $out;
   195 			wp_die();
   206 			wp_die();
   196 		} elseif ( 'no' == $_GET['test'] ) {
   207 		} elseif ( 'no' == $_GET['test'] ) {
   197 			check_ajax_referer( 'update_can_compress_scripts' );
   208 			check_ajax_referer( 'update_can_compress_scripts' );
   198 			update_site_option('can_compress_scripts', 0);
   209 			update_site_option( 'can_compress_scripts', 0 );
   199 		} elseif ( 'yes' == $_GET['test'] ) {
   210 		} elseif ( 'yes' == $_GET['test'] ) {
   200 			check_ajax_referer( 'update_can_compress_scripts' );
   211 			check_ajax_referer( 'update_can_compress_scripts' );
   201 			update_site_option('can_compress_scripts', 1);
   212 			update_site_option( 'can_compress_scripts', 1 );
   202 		}
   213 		}
   203 	}
   214 	}
   204 
   215 
   205 	wp_die( 0 );
   216 	wp_die( 0 );
   206 }
   217 }
   209  * Ajax handler for image editor previews.
   220  * Ajax handler for image editor previews.
   210  *
   221  *
   211  * @since 3.1.0
   222  * @since 3.1.0
   212  */
   223  */
   213 function wp_ajax_imgedit_preview() {
   224 function wp_ajax_imgedit_preview() {
   214 	$post_id = intval($_GET['postid']);
   225 	$post_id = intval( $_GET['postid'] );
   215 	if ( empty($post_id) || !current_user_can('edit_post', $post_id) )
   226 	if ( empty( $post_id ) || ! current_user_can( 'edit_post', $post_id ) ) {
   216 		wp_die( -1 );
   227 		wp_die( -1 );
       
   228 	}
   217 
   229 
   218 	check_ajax_referer( "image_editor-$post_id" );
   230 	check_ajax_referer( "image_editor-$post_id" );
   219 
   231 
   220 	include_once( ABSPATH . 'wp-admin/includes/image-edit.php' );
   232 	include_once( ABSPATH . 'wp-admin/includes/image-edit.php' );
   221 	if ( ! stream_preview_image($post_id) )
   233 	if ( ! stream_preview_image( $post_id ) ) {
   222 		wp_die( -1 );
   234 		wp_die( -1 );
       
   235 	}
   223 
   236 
   224 	wp_die();
   237 	wp_die();
   225 }
   238 }
   226 
   239 
   227 /**
   240 /**
   240  * Ajax handler for user autocomplete.
   253  * Ajax handler for user autocomplete.
   241  *
   254  *
   242  * @since 3.4.0
   255  * @since 3.4.0
   243  */
   256  */
   244 function wp_ajax_autocomplete_user() {
   257 function wp_ajax_autocomplete_user() {
   245 	if ( ! is_multisite() || ! current_user_can( 'promote_users' ) || wp_is_large_network( 'users' ) )
   258 	if ( ! is_multisite() || ! current_user_can( 'promote_users' ) || wp_is_large_network( 'users' ) ) {
   246 		wp_die( -1 );
   259 		wp_die( -1 );
       
   260 	}
   247 
   261 
   248 	/** This filter is documented in wp-admin/user-new.php */
   262 	/** This filter is documented in wp-admin/user-new.php */
   249 	if ( ! current_user_can( 'manage_network_users' ) && ! apply_filters( 'autocomplete_users_for_site_admins', false ) )
   263 	if ( ! current_user_can( 'manage_network_users' ) && ! apply_filters( 'autocomplete_users_for_site_admins', false ) ) {
   250 		wp_die( -1 );
   264 		wp_die( -1 );
       
   265 	}
   251 
   266 
   252 	$return = array();
   267 	$return = array();
   253 
   268 
   254 	// Check the type of request
   269 	// Check the type of request
   255 	// Current allowed values are `add` and `search`
   270 	// Current allowed values are `add` and `search`
   272 		$id = absint( $_REQUEST['site_id'] );
   287 		$id = absint( $_REQUEST['site_id'] );
   273 	} else {
   288 	} else {
   274 		$id = get_current_blog_id();
   289 		$id = get_current_blog_id();
   275 	}
   290 	}
   276 
   291 
   277 	$include_blog_users = ( $type == 'search' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );
   292 	$include_blog_users = ( $type == 'search' ? get_users(
   278 	$exclude_blog_users = ( $type == 'add' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );
   293 		array(
   279 
   294 			'blog_id' => $id,
   280 	$users = get_users( array(
   295 			'fields'  => 'ID',
   281 		'blog_id' => false,
   296 		)
   282 		'search'  => '*' . $_REQUEST['term'] . '*',
   297 	) : array() );
   283 		'include' => $include_blog_users,
   298 	$exclude_blog_users = ( $type == 'add' ? get_users(
   284 		'exclude' => $exclude_blog_users,
   299 		array(
   285 		'search_columns' => array( 'user_login', 'user_nicename', 'user_email' ),
   300 			'blog_id' => $id,
   286 	) );
   301 			'fields'  => 'ID',
       
   302 		)
       
   303 	) : array() );
       
   304 
       
   305 	$users = get_users(
       
   306 		array(
       
   307 			'blog_id'        => false,
       
   308 			'search'         => '*' . $_REQUEST['term'] . '*',
       
   309 			'include'        => $include_blog_users,
       
   310 			'exclude'        => $exclude_blog_users,
       
   311 			'search_columns' => array( 'user_login', 'user_nicename', 'user_email' ),
       
   312 		)
       
   313 	);
   287 
   314 
   288 	foreach ( $users as $user ) {
   315 	foreach ( $users as $user ) {
   289 		$return[] = array(
   316 		$return[] = array(
   290 			/* translators: 1: user_login, 2: user_email */
   317 			/* translators: 1: user_login, 2: user_email */
   291 			'label' => sprintf( _x( '%1$s (%2$s)', 'user autocomplete result' ), $user->user_login, $user->user_email ),
   318 			'label' => sprintf( _x( '%1$s (%2$s)', 'user autocomplete result' ), $user->user_login, $user->user_email ),
   313 	$events_client  = new WP_Community_Events( $user_id, $saved_location );
   340 	$events_client  = new WP_Community_Events( $user_id, $saved_location );
   314 	$events         = $events_client->get_events( $search, $timezone );
   341 	$events         = $events_client->get_events( $search, $timezone );
   315 	$ip_changed     = false;
   342 	$ip_changed     = false;
   316 
   343 
   317 	if ( is_wp_error( $events ) ) {
   344 	if ( is_wp_error( $events ) ) {
   318 		wp_send_json_error( array(
   345 		wp_send_json_error(
   319 			'error' => $events->get_error_message(),
   346 			array(
   320 		) );
   347 				'error' => $events->get_error_message(),
       
   348 			)
       
   349 		);
   321 	} else {
   350 	} else {
   322 		if ( empty( $saved_location['ip'] ) && ! empty( $events['location']['ip'] ) ) {
   351 		if ( empty( $saved_location['ip'] ) && ! empty( $events['location']['ip'] ) ) {
   323 			$ip_changed = true;
   352 			$ip_changed = true;
   324 		} elseif ( isset( $saved_location['ip'] ) && ! empty( $events['location']['ip'] ) && $saved_location['ip'] !== $events['location']['ip'] ) {
   353 		} elseif ( isset( $saved_location['ip'] ) && ! empty( $events['location']['ip'] ) && $saved_location['ip'] !== $events['location']['ip'] ) {
   325 			$ip_changed = true;
   354 			$ip_changed = true;
   327 
   356 
   328 		/*
   357 		/*
   329 		 * The location should only be updated when it changes. The API doesn't always return
   358 		 * The location should only be updated when it changes. The API doesn't always return
   330 		 * a full location; sometimes it's missing the description or country. The location
   359 		 * a full location; sometimes it's missing the description or country. The location
   331 		 * that was saved during the initial request is known to be good and complete, though.
   360 		 * that was saved during the initial request is known to be good and complete, though.
   332 		 * It should be left in tact until the user explicitly changes it (either by manually
   361 		 * It should be left intact until the user explicitly changes it (either by manually
   333 		 * searching for a new location, or by changing their IP address).
   362 		 * searching for a new location, or by changing their IP address).
   334 		 *
   363 		 *
   335 		 * If the location were updated with an incomplete response from the API, then it could
   364 		 * If the location was updated with an incomplete response from the API, then it could
   336 		 * break assumptions that the UI makes (e.g., that there will always be a description
   365 		 * break assumptions that the UI makes (e.g., that there will always be a description
   337 		 * that corresponds to a latitude/longitude location).
   366 		 * that corresponds to a latitude/longitude location).
   338 		 *
   367 		 *
   339 		 * The location is stored network-wide, so that the user doesn't have to set it on each site.
   368 		 * The location is stored network-wide, so that the user doesn't have to set it on each site.
   340 		 */
   369 		 */
   358 	if ( $pagenow === 'dashboard-user' || $pagenow === 'dashboard-network' || $pagenow === 'dashboard' ) {
   387 	if ( $pagenow === 'dashboard-user' || $pagenow === 'dashboard-network' || $pagenow === 'dashboard' ) {
   359 		set_current_screen( $pagenow );
   388 		set_current_screen( $pagenow );
   360 	}
   389 	}
   361 
   390 
   362 	switch ( $_GET['widget'] ) {
   391 	switch ( $_GET['widget'] ) {
   363 		case 'dashboard_primary' :
   392 		case 'dashboard_primary':
   364 			wp_dashboard_primary();
   393 			wp_dashboard_primary();
   365 			break;
   394 			break;
   366 	}
   395 	}
   367 	wp_die();
   396 	wp_die();
   368 }
   397 }
   390  *
   419  *
   391  * @param int $comment_id
   420  * @param int $comment_id
   392  * @param int $delta
   421  * @param int $delta
   393  */
   422  */
   394 function _wp_ajax_delete_comment_response( $comment_id, $delta = -1 ) {
   423 function _wp_ajax_delete_comment_response( $comment_id, $delta = -1 ) {
   395 	$total    = isset( $_POST['_total'] )    ? (int) $_POST['_total']    : 0;
   424 	$total    = isset( $_POST['_total'] ) ? (int) $_POST['_total'] : 0;
   396 	$per_page = isset( $_POST['_per_page'] ) ? (int) $_POST['_per_page'] : 0;
   425 	$per_page = isset( $_POST['_per_page'] ) ? (int) $_POST['_per_page'] : 0;
   397 	$page     = isset( $_POST['_page'] )     ? (int) $_POST['_page']     : 0;
   426 	$page     = isset( $_POST['_page'] ) ? (int) $_POST['_page'] : 0;
   398 	$url      = isset( $_POST['_url'] )      ? esc_url_raw( $_POST['_url'] ) : '';
   427 	$url      = isset( $_POST['_url'] ) ? esc_url_raw( $_POST['_url'] ) : '';
   399 
   428 
   400 	// JS didn't send us everything we need to know. Just die with success message
   429 	// JS didn't send us everything we need to know. Just die with success message
   401 	if ( ! $total || ! $per_page || ! $page || ! $url ) {
   430 	if ( ! $total || ! $per_page || ! $page || ! $url ) {
   402 		$time           = time();
   431 		$time           = time();
   403 		$comment        = get_comment( $comment_id );
   432 		$comment        = get_comment( $comment_id );
   412 			$comment_link = get_comment_link( $comment );
   441 			$comment_link = get_comment_link( $comment );
   413 		}
   442 		}
   414 
   443 
   415 		$counts = wp_count_comments();
   444 		$counts = wp_count_comments();
   416 
   445 
   417 		$x = new WP_Ajax_Response( array(
   446 		$x = new WP_Ajax_Response(
   418 			'what' => 'comment',
   447 			array(
   419 			// Here for completeness - not used.
   448 				'what'         => 'comment',
   420 			'id' => $comment_id,
   449 				// Here for completeness - not used.
   421 			'supplemental' => array(
   450 				'id'           => $comment_id,
   422 				'status' => $comment_status,
   451 				'supplemental' => array(
   423 				'postId' => $comment ? $comment->comment_post_ID : '',
   452 					'status'               => $comment_status,
   424 				'time' => $time,
   453 					'postId'               => $comment ? $comment->comment_post_ID : '',
   425 				'in_moderation' => $counts->moderated,
   454 					'time'                 => $time,
   426 				'i18n_comments_text' => sprintf(
   455 					'in_moderation'        => $counts->moderated,
   427 					_n( '%s Comment', '%s Comments', $counts->approved ),
   456 					'i18n_comments_text'   => sprintf(
   428 					number_format_i18n( $counts->approved )
   457 						/* translators: %s: number of comments approved */
       
   458 						_n( '%s Comment', '%s Comments', $counts->approved ),
       
   459 						number_format_i18n( $counts->approved )
       
   460 					),
       
   461 					'i18n_moderation_text' => sprintf(
       
   462 						/* translators: %s: number of comments in moderation */
       
   463 						_n( '%s Comment in moderation', '%s Comments in moderation', $counts->moderated ),
       
   464 						number_format_i18n( $counts->moderated )
       
   465 					),
       
   466 					'comment_link'         => $comment_link,
   429 				),
   467 				),
   430 				'i18n_moderation_text' => sprintf(
       
   431 					_nx( '%s in moderation', '%s in moderation', $counts->moderated, 'comments' ),
       
   432 					number_format_i18n( $counts->moderated )
       
   433 				),
       
   434 				'comment_link' => $comment_link,
       
   435 			)
   468 			)
   436 		) );
   469 		);
   437 		$x->send();
   470 		$x->send();
   438 	}
   471 	}
   439 
   472 
   440 	$total += $delta;
   473 	$total += $delta;
   441 	if ( $total < 0 )
   474 	if ( $total < 0 ) {
   442 		$total = 0;
   475 		$total = 0;
       
   476 	}
   443 
   477 
   444 	// Only do the expensive stuff on a page-break, and about 1 other time per page
   478 	// Only do the expensive stuff on a page-break, and about 1 other time per page
   445 	if ( 0 == $total % $per_page || 1 == mt_rand( 1, $per_page ) ) {
   479 	if ( 0 == $total % $per_page || 1 == mt_rand( 1, $per_page ) ) {
   446 		$post_id = 0;
   480 		$post_id = 0;
   447 		// What type of comment count are we looking for?
   481 		// What type of comment count are we looking for?
   448 		$status = 'all';
   482 		$status = 'all';
   449 		$parsed = parse_url( $url );
   483 		$parsed = parse_url( $url );
   450 		if ( isset( $parsed['query'] ) ) {
   484 		if ( isset( $parsed['query'] ) ) {
   451 			parse_str( $parsed['query'], $query_vars );
   485 			parse_str( $parsed['query'], $query_vars );
   452 			if ( !empty( $query_vars['comment_status'] ) )
   486 			if ( ! empty( $query_vars['comment_status'] ) ) {
   453 				$status = $query_vars['comment_status'];
   487 				$status = $query_vars['comment_status'];
   454 			if ( !empty( $query_vars['p'] ) )
   488 			}
       
   489 			if ( ! empty( $query_vars['p'] ) ) {
   455 				$post_id = (int) $query_vars['p'];
   490 				$post_id = (int) $query_vars['p'];
   456 			if ( ! empty( $query_vars['comment_type'] ) )
   491 			}
       
   492 			if ( ! empty( $query_vars['comment_type'] ) ) {
   457 				$type = $query_vars['comment_type'];
   493 				$type = $query_vars['comment_type'];
       
   494 			}
   458 		}
   495 		}
   459 
   496 
   460 		if ( empty( $type ) ) {
   497 		if ( empty( $type ) ) {
   461 			// Only use the comment count if not filtering by a comment_type.
   498 			// Only use the comment count if not filtering by a comment_type.
   462 			$comment_count = wp_count_comments($post_id);
   499 			$comment_count = wp_count_comments( $post_id );
   463 
   500 
   464 			// We're looking for a known type of comment count.
   501 			// We're looking for a known type of comment count.
   465 			if ( isset( $comment_count->$status ) ) {
   502 			if ( isset( $comment_count->$status ) ) {
   466 				$total = $comment_count->$status;
   503 				$total = $comment_count->$status;
   467 			}
   504 			}
   468 		}
   505 		}
   469 		// Else use the decremented value from above.
   506 		// Else use the decremented value from above.
   470 	}
   507 	}
   471 
   508 
   472 	// The time since the last comment count.
   509 	// The time since the last comment count.
   473 	$time = time();
   510 	$time    = time();
   474 	$comment = get_comment( $comment_id );
   511 	$comment = get_comment( $comment_id );
   475 
   512 	$counts  = wp_count_comments();
   476 	$x = new WP_Ajax_Response( array(
   513 
   477 		'what' => 'comment',
   514 	$x = new WP_Ajax_Response(
   478 		// Here for completeness - not used.
   515 		array(
   479 		'id' => $comment_id,
   516 			'what'         => 'comment',
   480 		'supplemental' => array(
   517 			'id'           => $comment_id,
   481 			'status' => $comment ? $comment->comment_approved : '',
   518 			'supplemental' => array(
   482 			'postId' => $comment ? $comment->comment_post_ID : '',
   519 				'status'               => $comment ? $comment->comment_approved : '',
   483 			'total_items_i18n' => sprintf( _n( '%s item', '%s items', $total ), number_format_i18n( $total ) ),
   520 				'postId'               => $comment ? $comment->comment_post_ID : '',
   484 			'total_pages' => ceil( $total / $per_page ),
   521 				/* translators: %s: number of comments */
   485 			'total_pages_i18n' => number_format_i18n( ceil( $total / $per_page ) ),
   522 				'total_items_i18n'     => sprintf( _n( '%s item', '%s items', $total ), number_format_i18n( $total ) ),
   486 			'total' => $total,
   523 				'total_pages'          => ceil( $total / $per_page ),
   487 			'time' => $time
   524 				'total_pages_i18n'     => number_format_i18n( ceil( $total / $per_page ) ),
       
   525 				'total'                => $total,
       
   526 				'time'                 => $time,
       
   527 				'in_moderation'        => $counts->moderated,
       
   528 				'i18n_moderation_text' => sprintf(
       
   529 					/* translators: %s: number of comments in moderation */
       
   530 					_n( '%s Comment in moderation', '%s Comments in moderation', $counts->moderated ),
       
   531 					number_format_i18n( $counts->moderated )
       
   532 				),
       
   533 			),
   488 		)
   534 		)
   489 	) );
   535 	);
   490 	$x->send();
   536 	$x->send();
   491 }
   537 }
   492 
   538 
   493 //
   539 //
   494 // POST-based Ajax handlers.
   540 // POST-based Ajax handlers.
   499  *
   545  *
   500  * @access private
   546  * @access private
   501  * @since 3.1.0
   547  * @since 3.1.0
   502  */
   548  */
   503 function _wp_ajax_add_hierarchical_term() {
   549 function _wp_ajax_add_hierarchical_term() {
   504 	$action = $_POST['action'];
   550 	$action   = $_POST['action'];
   505 	$taxonomy = get_taxonomy(substr($action, 4));
   551 	$taxonomy = get_taxonomy( substr( $action, 4 ) );
   506 	check_ajax_referer( $action, '_ajax_nonce-add-' . $taxonomy->name );
   552 	check_ajax_referer( $action, '_ajax_nonce-add-' . $taxonomy->name );
   507 	if ( !current_user_can( $taxonomy->cap->edit_terms ) )
   553 	if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
   508 		wp_die( -1 );
   554 		wp_die( -1 );
   509 	$names = explode(',', $_POST['new'.$taxonomy->name]);
   555 	}
   510 	$parent = isset($_POST['new'.$taxonomy->name.'_parent']) ? (int) $_POST['new'.$taxonomy->name.'_parent'] : 0;
   556 	$names  = explode( ',', $_POST[ 'new' . $taxonomy->name ] );
   511 	if ( 0 > $parent )
   557 	$parent = isset( $_POST[ 'new' . $taxonomy->name . '_parent' ] ) ? (int) $_POST[ 'new' . $taxonomy->name . '_parent' ] : 0;
       
   558 	if ( 0 > $parent ) {
   512 		$parent = 0;
   559 		$parent = 0;
   513 	if ( $taxonomy->name == 'category' )
   560 	}
   514 		$post_category = isset($_POST['post_category']) ? (array) $_POST['post_category'] : array();
   561 	if ( $taxonomy->name == 'category' ) {
   515 	else
   562 		$post_category = isset( $_POST['post_category'] ) ? (array) $_POST['post_category'] : array();
   516 		$post_category = ( isset($_POST['tax_input']) && isset($_POST['tax_input'][$taxonomy->name]) ) ? (array) $_POST['tax_input'][$taxonomy->name] : array();
   563 	} else {
       
   564 		$post_category = ( isset( $_POST['tax_input'] ) && isset( $_POST['tax_input'][ $taxonomy->name ] ) ) ? (array) $_POST['tax_input'][ $taxonomy->name ] : array();
       
   565 	}
   517 	$checked_categories = array_map( 'absint', (array) $post_category );
   566 	$checked_categories = array_map( 'absint', (array) $post_category );
   518 	$popular_ids = wp_popular_terms_checklist($taxonomy->name, 0, 10, false);
   567 	$popular_ids        = wp_popular_terms_checklist( $taxonomy->name, 0, 10, false );
   519 
   568 
   520 	foreach ( $names as $cat_name ) {
   569 	foreach ( $names as $cat_name ) {
   521 		$cat_name = trim($cat_name);
   570 		$cat_name          = trim( $cat_name );
   522 		$category_nicename = sanitize_title($cat_name);
   571 		$category_nicename = sanitize_title( $cat_name );
   523 		if ( '' === $category_nicename )
   572 		if ( '' === $category_nicename ) {
   524 			continue;
   573 			continue;
       
   574 		}
   525 
   575 
   526 		$cat_id = wp_insert_term( $cat_name, $taxonomy->name, array( 'parent' => $parent ) );
   576 		$cat_id = wp_insert_term( $cat_name, $taxonomy->name, array( 'parent' => $parent ) );
   527 		if ( ! $cat_id || is_wp_error( $cat_id ) ) {
   577 		if ( ! $cat_id || is_wp_error( $cat_id ) ) {
   528 			continue;
   578 			continue;
   529 		} else {
   579 		} else {
   530 			$cat_id = $cat_id['term_id'];
   580 			$cat_id = $cat_id['term_id'];
   531 		}
   581 		}
   532 		$checked_categories[] = $cat_id;
   582 		$checked_categories[] = $cat_id;
   533 		if ( $parent ) // Do these all at once in a second
   583 		if ( $parent ) { // Do these all at once in a second
   534 			continue;
   584 			continue;
       
   585 		}
   535 
   586 
   536 		ob_start();
   587 		ob_start();
   537 
   588 
   538 		wp_terms_checklist( 0, array( 'taxonomy' => $taxonomy->name, 'descendants_and_self' => $cat_id, 'selected_cats' => $checked_categories, 'popular_cats' => $popular_ids ));
   589 		wp_terms_checklist(
       
   590 			0,
       
   591 			array(
       
   592 				'taxonomy'             => $taxonomy->name,
       
   593 				'descendants_and_self' => $cat_id,
       
   594 				'selected_cats'        => $checked_categories,
       
   595 				'popular_cats'         => $popular_ids,
       
   596 			)
       
   597 		);
   539 
   598 
   540 		$data = ob_get_clean();
   599 		$data = ob_get_clean();
   541 
   600 
   542 		$add = array(
   601 		$add = array(
   543 			'what' => $taxonomy->name,
   602 			'what'     => $taxonomy->name,
   544 			'id' => $cat_id,
   603 			'id'       => $cat_id,
   545 			'data' => str_replace( array("\n", "\t"), '', $data),
   604 			'data'     => str_replace( array( "\n", "\t" ), '', $data ),
   546 			'position' => -1
   605 			'position' => -1,
   547 		);
   606 		);
   548 	}
   607 	}
   549 
   608 
   550 	if ( $parent ) { // Foncy - replace the parent and all its children
   609 	if ( $parent ) { // Foncy - replace the parent and all its children
   551 		$parent = get_term( $parent, $taxonomy->name );
   610 		$parent  = get_term( $parent, $taxonomy->name );
   552 		$term_id = $parent->term_id;
   611 		$term_id = $parent->term_id;
   553 
   612 
   554 		while ( $parent->parent ) { // get the top parent
   613 		while ( $parent->parent ) { // get the top parent
   555 			$parent = get_term( $parent->parent, $taxonomy->name );
   614 			$parent = get_term( $parent->parent, $taxonomy->name );
   556 			if ( is_wp_error( $parent ) )
   615 			if ( is_wp_error( $parent ) ) {
   557 				break;
   616 				break;
       
   617 			}
   558 			$term_id = $parent->term_id;
   618 			$term_id = $parent->term_id;
   559 		}
   619 		}
   560 
   620 
   561 		ob_start();
   621 		ob_start();
   562 
   622 
   563 		wp_terms_checklist( 0, array('taxonomy' => $taxonomy->name, 'descendants_and_self' => $term_id, 'selected_cats' => $checked_categories, 'popular_cats' => $popular_ids));
   623 		wp_terms_checklist(
       
   624 			0,
       
   625 			array(
       
   626 				'taxonomy'             => $taxonomy->name,
       
   627 				'descendants_and_self' => $term_id,
       
   628 				'selected_cats'        => $checked_categories,
       
   629 				'popular_cats'         => $popular_ids,
       
   630 			)
       
   631 		);
   564 
   632 
   565 		$data = ob_get_clean();
   633 		$data = ob_get_clean();
   566 
   634 
   567 		$add = array(
   635 		$add = array(
   568 			'what' => $taxonomy->name,
   636 			'what'     => $taxonomy->name,
   569 			'id' => $term_id,
   637 			'id'       => $term_id,
   570 			'data' => str_replace( array("\n", "\t"), '', $data),
   638 			'data'     => str_replace( array( "\n", "\t" ), '', $data ),
   571 			'position' => -1
   639 			'position' => -1,
   572 		);
   640 		);
   573 	}
   641 	}
   574 
   642 
   575 	ob_start();
   643 	ob_start();
   576 
   644 
   577 	wp_dropdown_categories( array(
   645 	wp_dropdown_categories(
   578 		'taxonomy' => $taxonomy->name, 'hide_empty' => 0, 'name' => 'new'.$taxonomy->name.'_parent', 'orderby' => 'name',
   646 		array(
   579 		'hierarchical' => 1, 'show_option_none' => '&mdash; '.$taxonomy->labels->parent_item.' &mdash;'
   647 			'taxonomy'         => $taxonomy->name,
   580 	) );
   648 			'hide_empty'       => 0,
       
   649 			'name'             => 'new' . $taxonomy->name . '_parent',
       
   650 			'orderby'          => 'name',
       
   651 			'hierarchical'     => 1,
       
   652 			'show_option_none' => '&mdash; ' . $taxonomy->labels->parent_item . ' &mdash;',
       
   653 		)
       
   654 	);
   581 
   655 
   582 	$sup = ob_get_clean();
   656 	$sup = ob_get_clean();
   583 
   657 
   584 	$add['supplemental'] = array( 'newcat_parent' => $sup );
   658 	$add['supplemental'] = array( 'newcat_parent' => $sup );
   585 
   659 
   593  * @since 3.1.0
   667  * @since 3.1.0
   594  */
   668  */
   595 function wp_ajax_delete_comment() {
   669 function wp_ajax_delete_comment() {
   596 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   670 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   597 
   671 
   598 	if ( !$comment = get_comment( $id ) )
   672 	if ( ! $comment = get_comment( $id ) ) {
   599 		wp_die( time() );
   673 		wp_die( time() );
   600 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) )
   674 	}
       
   675 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) ) {
   601 		wp_die( -1 );
   676 		wp_die( -1 );
       
   677 	}
   602 
   678 
   603 	check_ajax_referer( "delete-comment_$id" );
   679 	check_ajax_referer( "delete-comment_$id" );
   604 	$status = wp_get_comment_status( $comment );
   680 	$status = wp_get_comment_status( $comment );
   605 
   681 
   606 	$delta = -1;
   682 	$delta = -1;
   607 	if ( isset($_POST['trash']) && 1 == $_POST['trash'] ) {
   683 	if ( isset( $_POST['trash'] ) && 1 == $_POST['trash'] ) {
   608 		if ( 'trash' == $status )
   684 		if ( 'trash' == $status ) {
   609 			wp_die( time() );
   685 			wp_die( time() );
       
   686 		}
   610 		$r = wp_trash_comment( $comment );
   687 		$r = wp_trash_comment( $comment );
   611 	} elseif ( isset($_POST['untrash']) && 1 == $_POST['untrash'] ) {
   688 	} elseif ( isset( $_POST['untrash'] ) && 1 == $_POST['untrash'] ) {
   612 		if ( 'trash' != $status )
   689 		if ( 'trash' != $status ) {
   613 			wp_die( time() );
   690 			wp_die( time() );
       
   691 		}
   614 		$r = wp_untrash_comment( $comment );
   692 		$r = wp_untrash_comment( $comment );
   615 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'trash' ) // undo trash, not in trash
   693 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'trash' ) { // undo trash, not in trash
   616 			$delta = 1;
   694 			$delta = 1;
   617 	} elseif ( isset($_POST['spam']) && 1 == $_POST['spam'] ) {
   695 		}
   618 		if ( 'spam' == $status )
   696 	} elseif ( isset( $_POST['spam'] ) && 1 == $_POST['spam'] ) {
       
   697 		if ( 'spam' == $status ) {
   619 			wp_die( time() );
   698 			wp_die( time() );
       
   699 		}
   620 		$r = wp_spam_comment( $comment );
   700 		$r = wp_spam_comment( $comment );
   621 	} elseif ( isset($_POST['unspam']) && 1 == $_POST['unspam'] ) {
   701 	} elseif ( isset( $_POST['unspam'] ) && 1 == $_POST['unspam'] ) {
   622 		if ( 'spam' != $status )
   702 		if ( 'spam' != $status ) {
   623 			wp_die( time() );
   703 			wp_die( time() );
       
   704 		}
   624 		$r = wp_unspam_comment( $comment );
   705 		$r = wp_unspam_comment( $comment );
   625 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'spam' ) // undo spam, not in spam
   706 		if ( ! isset( $_POST['comment_status'] ) || $_POST['comment_status'] != 'spam' ) { // undo spam, not in spam
   626 			$delta = 1;
   707 			$delta = 1;
   627 	} elseif ( isset($_POST['delete']) && 1 == $_POST['delete'] ) {
   708 		}
       
   709 	} elseif ( isset( $_POST['delete'] ) && 1 == $_POST['delete'] ) {
   628 		$r = wp_delete_comment( $comment );
   710 		$r = wp_delete_comment( $comment );
   629 	} else {
   711 	} else {
   630 		wp_die( -1 );
   712 		wp_die( -1 );
   631 	}
   713 	}
   632 
   714 
   633 	if ( $r ) // Decide if we need to send back '1' or a more complicated response including page links and comment counts
   715 	if ( $r ) { // Decide if we need to send back '1' or a more complicated response including page links and comment counts
   634 		_wp_ajax_delete_comment_response( $comment->comment_ID, $delta );
   716 		_wp_ajax_delete_comment_response( $comment->comment_ID, $delta );
       
   717 	}
   635 	wp_die( 0 );
   718 	wp_die( 0 );
   636 }
   719 }
   637 
   720 
   638 /**
   721 /**
   639  * Ajax handler for deleting a tag.
   722  * Ajax handler for deleting a tag.
   646 
   729 
   647 	if ( ! current_user_can( 'delete_term', $tag_id ) ) {
   730 	if ( ! current_user_can( 'delete_term', $tag_id ) ) {
   648 		wp_die( -1 );
   731 		wp_die( -1 );
   649 	}
   732 	}
   650 
   733 
   651 	$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
   734 	$taxonomy = ! empty( $_POST['taxonomy'] ) ? $_POST['taxonomy'] : 'post_tag';
   652 	$tag = get_term( $tag_id, $taxonomy );
   735 	$tag      = get_term( $tag_id, $taxonomy );
   653 	if ( !$tag || is_wp_error( $tag ) )
   736 	if ( ! $tag || is_wp_error( $tag ) ) {
   654 		wp_die( 1 );
   737 		wp_die( 1 );
   655 
   738 	}
   656 	if ( wp_delete_term($tag_id, $taxonomy))
   739 
       
   740 	if ( wp_delete_term( $tag_id, $taxonomy ) ) {
   657 		wp_die( 1 );
   741 		wp_die( 1 );
   658 	else
   742 	} else {
   659 		wp_die( 0 );
   743 		wp_die( 0 );
       
   744 	}
   660 }
   745 }
   661 
   746 
   662 /**
   747 /**
   663  * Ajax handler for deleting a link.
   748  * Ajax handler for deleting a link.
   664  *
   749  *
   666  */
   751  */
   667 function wp_ajax_delete_link() {
   752 function wp_ajax_delete_link() {
   668 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   753 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   669 
   754 
   670 	check_ajax_referer( "delete-bookmark_$id" );
   755 	check_ajax_referer( "delete-bookmark_$id" );
   671 	if ( !current_user_can( 'manage_links' ) )
   756 	if ( ! current_user_can( 'manage_links' ) ) {
   672 		wp_die( -1 );
   757 		wp_die( -1 );
       
   758 	}
   673 
   759 
   674 	$link = get_bookmark( $id );
   760 	$link = get_bookmark( $id );
   675 	if ( !$link || is_wp_error( $link ) )
   761 	if ( ! $link || is_wp_error( $link ) ) {
   676 		wp_die( 1 );
   762 		wp_die( 1 );
   677 
   763 	}
   678 	if ( wp_delete_link( $id ) )
   764 
       
   765 	if ( wp_delete_link( $id ) ) {
   679 		wp_die( 1 );
   766 		wp_die( 1 );
   680 	else
   767 	} else {
   681 		wp_die( 0 );
   768 		wp_die( 0 );
       
   769 	}
   682 }
   770 }
   683 
   771 
   684 /**
   772 /**
   685  * Ajax handler for deleting meta.
   773  * Ajax handler for deleting meta.
   686  *
   774  *
   688  */
   776  */
   689 function wp_ajax_delete_meta() {
   777 function wp_ajax_delete_meta() {
   690 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   778 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   691 
   779 
   692 	check_ajax_referer( "delete-meta_$id" );
   780 	check_ajax_referer( "delete-meta_$id" );
   693 	if ( !$meta = get_metadata_by_mid( 'post', $id ) )
   781 	if ( ! $meta = get_metadata_by_mid( 'post', $id ) ) {
   694 		wp_die( 1 );
   782 		wp_die( 1 );
   695 
   783 	}
   696 	if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta',  $meta->post_id, $meta->meta_key ) )
   784 
       
   785 	if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $meta->post_id, $meta->meta_key ) ) {
   697 		wp_die( -1 );
   786 		wp_die( -1 );
   698 	if ( delete_meta( $meta->meta_id ) )
   787 	}
       
   788 	if ( delete_meta( $meta->meta_id ) ) {
   699 		wp_die( 1 );
   789 		wp_die( 1 );
       
   790 	}
   700 	wp_die( 0 );
   791 	wp_die( 0 );
   701 }
   792 }
   702 
   793 
   703 /**
   794 /**
   704  * Ajax handler for deleting a post.
   795  * Ajax handler for deleting a post.
   706  * @since 3.1.0
   797  * @since 3.1.0
   707  *
   798  *
   708  * @param string $action Action to perform.
   799  * @param string $action Action to perform.
   709  */
   800  */
   710 function wp_ajax_delete_post( $action ) {
   801 function wp_ajax_delete_post( $action ) {
   711 	if ( empty( $action ) )
   802 	if ( empty( $action ) ) {
   712 		$action = 'delete-post';
   803 		$action = 'delete-post';
       
   804 	}
   713 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   805 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   714 
   806 
   715 	check_ajax_referer( "{$action}_$id" );
   807 	check_ajax_referer( "{$action}_$id" );
   716 	if ( !current_user_can( 'delete_post', $id ) )
   808 	if ( ! current_user_can( 'delete_post', $id ) ) {
   717 		wp_die( -1 );
   809 		wp_die( -1 );
   718 
   810 	}
   719 	if ( !get_post( $id ) )
   811 
       
   812 	if ( ! get_post( $id ) ) {
   720 		wp_die( 1 );
   813 		wp_die( 1 );
   721 
   814 	}
   722 	if ( wp_delete_post( $id ) )
   815 
       
   816 	if ( wp_delete_post( $id ) ) {
   723 		wp_die( 1 );
   817 		wp_die( 1 );
   724 	else
   818 	} else {
   725 		wp_die( 0 );
   819 		wp_die( 0 );
       
   820 	}
   726 }
   821 }
   727 
   822 
   728 /**
   823 /**
   729  * Ajax handler for sending a post to the trash.
   824  * Ajax handler for sending a post to the trash.
   730  *
   825  *
   731  * @since 3.1.0
   826  * @since 3.1.0
   732  *
   827  *
   733  * @param string $action Action to perform.
   828  * @param string $action Action to perform.
   734  */
   829  */
   735 function wp_ajax_trash_post( $action ) {
   830 function wp_ajax_trash_post( $action ) {
   736 	if ( empty( $action ) )
   831 	if ( empty( $action ) ) {
   737 		$action = 'trash-post';
   832 		$action = 'trash-post';
       
   833 	}
   738 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   834 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   739 
   835 
   740 	check_ajax_referer( "{$action}_$id" );
   836 	check_ajax_referer( "{$action}_$id" );
   741 	if ( !current_user_can( 'delete_post', $id ) )
   837 	if ( ! current_user_can( 'delete_post', $id ) ) {
   742 		wp_die( -1 );
   838 		wp_die( -1 );
   743 
   839 	}
   744 	if ( !get_post( $id ) )
   840 
       
   841 	if ( ! get_post( $id ) ) {
   745 		wp_die( 1 );
   842 		wp_die( 1 );
   746 
   843 	}
   747 	if ( 'trash-post' == $action )
   844 
       
   845 	if ( 'trash-post' == $action ) {
   748 		$done = wp_trash_post( $id );
   846 		$done = wp_trash_post( $id );
   749 	else
   847 	} else {
   750 		$done = wp_untrash_post( $id );
   848 		$done = wp_untrash_post( $id );
   751 
   849 	}
   752 	if ( $done )
   850 
       
   851 	if ( $done ) {
   753 		wp_die( 1 );
   852 		wp_die( 1 );
       
   853 	}
   754 
   854 
   755 	wp_die( 0 );
   855 	wp_die( 0 );
   756 }
   856 }
   757 
   857 
   758 /**
   858 /**
   761  * @since 3.1.0
   861  * @since 3.1.0
   762  *
   862  *
   763  * @param string $action Action to perform.
   863  * @param string $action Action to perform.
   764  */
   864  */
   765 function wp_ajax_untrash_post( $action ) {
   865 function wp_ajax_untrash_post( $action ) {
   766 	if ( empty( $action ) )
   866 	if ( empty( $action ) ) {
   767 		$action = 'untrash-post';
   867 		$action = 'untrash-post';
       
   868 	}
   768 	wp_ajax_trash_post( $action );
   869 	wp_ajax_trash_post( $action );
   769 }
   870 }
   770 
   871 
   771 /**
   872 /**
       
   873  * Ajax handler to delete a page.
       
   874  *
   772  * @since 3.1.0
   875  * @since 3.1.0
   773  *
   876  *
   774  * @param string $action
   877  * @param string $action Action to perform.
   775  */
   878  */
   776 function wp_ajax_delete_page( $action ) {
   879 function wp_ajax_delete_page( $action ) {
   777 	if ( empty( $action ) )
   880 	if ( empty( $action ) ) {
   778 		$action = 'delete-page';
   881 		$action = 'delete-page';
       
   882 	}
   779 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   883 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   780 
   884 
   781 	check_ajax_referer( "{$action}_$id" );
   885 	check_ajax_referer( "{$action}_$id" );
   782 	if ( !current_user_can( 'delete_page', $id ) )
   886 	if ( ! current_user_can( 'delete_page', $id ) ) {
   783 		wp_die( -1 );
   887 		wp_die( -1 );
   784 
   888 	}
   785 	if ( ! get_post( $id ) )
   889 
       
   890 	if ( ! get_post( $id ) ) {
   786 		wp_die( 1 );
   891 		wp_die( 1 );
   787 
   892 	}
   788 	if ( wp_delete_post( $id ) )
   893 
       
   894 	if ( wp_delete_post( $id ) ) {
   789 		wp_die( 1 );
   895 		wp_die( 1 );
   790 	else
   896 	} else {
   791 		wp_die( 0 );
   897 		wp_die( 0 );
       
   898 	}
   792 }
   899 }
   793 
   900 
   794 /**
   901 /**
   795  * Ajax handler to dim a comment.
   902  * Ajax handler to dim a comment.
   796  *
   903  *
   797  * @since 3.1.0
   904  * @since 3.1.0
   798  */
   905  */
   799 function wp_ajax_dim_comment() {
   906 function wp_ajax_dim_comment() {
   800 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   907 	$id = isset( $_POST['id'] ) ? (int) $_POST['id'] : 0;
   801 
   908 
   802 	if ( !$comment = get_comment( $id ) ) {
   909 	if ( ! $comment = get_comment( $id ) ) {
   803 		$x = new WP_Ajax_Response( array(
   910 		$x = new WP_Ajax_Response(
   804 			'what' => 'comment',
   911 			array(
   805 			'id' => new WP_Error('invalid_comment', sprintf(__('Comment %d does not exist'), $id))
   912 				'what' => 'comment',
   806 		) );
   913 				/* translators: %d: comment ID */
       
   914 				'id'   => new WP_Error( 'invalid_comment', sprintf( __( 'Comment %d does not exist' ), $id ) ),
       
   915 			)
       
   916 		);
   807 		$x->send();
   917 		$x->send();
   808 	}
   918 	}
   809 
   919 
   810 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) && ! current_user_can( 'moderate_comments' ) )
   920 	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) && ! current_user_can( 'moderate_comments' ) ) {
   811 		wp_die( -1 );
   921 		wp_die( -1 );
       
   922 	}
   812 
   923 
   813 	$current = wp_get_comment_status( $comment );
   924 	$current = wp_get_comment_status( $comment );
   814 	if ( isset( $_POST['new'] ) && $_POST['new'] == $current )
   925 	if ( isset( $_POST['new'] ) && $_POST['new'] == $current ) {
   815 		wp_die( time() );
   926 		wp_die( time() );
       
   927 	}
   816 
   928 
   817 	check_ajax_referer( "approve-comment_$id" );
   929 	check_ajax_referer( "approve-comment_$id" );
   818 	if ( in_array( $current, array( 'unapproved', 'spam' ) ) ) {
   930 	if ( in_array( $current, array( 'unapproved', 'spam' ) ) ) {
   819 		$result = wp_set_comment_status( $comment, 'approve', true );
   931 		$result = wp_set_comment_status( $comment, 'approve', true );
   820 	} else {
   932 	} else {
   821 		$result = wp_set_comment_status( $comment, 'hold', true );
   933 		$result = wp_set_comment_status( $comment, 'hold', true );
   822 	}
   934 	}
   823 
   935 
   824 	if ( is_wp_error($result) ) {
   936 	if ( is_wp_error( $result ) ) {
   825 		$x = new WP_Ajax_Response( array(
   937 		$x = new WP_Ajax_Response(
   826 			'what' => 'comment',
   938 			array(
   827 			'id' => $result
   939 				'what' => 'comment',
   828 		) );
   940 				'id'   => $result,
       
   941 			)
       
   942 		);
   829 		$x->send();
   943 		$x->send();
   830 	}
   944 	}
   831 
   945 
   832 	// Decide if we need to send back '1' or a more complicated response including page links and comment counts
   946 	// Decide if we need to send back '1' or a more complicated response including page links and comment counts
   833 	_wp_ajax_delete_comment_response( $comment->comment_ID );
   947 	_wp_ajax_delete_comment_response( $comment->comment_ID );
   840  * @since 3.1.0
   954  * @since 3.1.0
   841  *
   955  *
   842  * @param string $action Action to perform.
   956  * @param string $action Action to perform.
   843  */
   957  */
   844 function wp_ajax_add_link_category( $action ) {
   958 function wp_ajax_add_link_category( $action ) {
   845 	if ( empty( $action ) )
   959 	if ( empty( $action ) ) {
   846 		$action = 'add-link-category';
   960 		$action = 'add-link-category';
       
   961 	}
   847 	check_ajax_referer( $action );
   962 	check_ajax_referer( $action );
   848 	$tax = get_taxonomy( 'link_category' );
   963 	$tax = get_taxonomy( 'link_category' );
   849 	if ( ! current_user_can( $tax->cap->manage_terms ) ) {
   964 	if ( ! current_user_can( $tax->cap->manage_terms ) ) {
   850 		wp_die( -1 );
   965 		wp_die( -1 );
   851 	}
   966 	}
   852 	$names = explode(',', wp_unslash( $_POST['newcat'] ) );
   967 	$names = explode( ',', wp_unslash( $_POST['newcat'] ) );
   853 	$x = new WP_Ajax_Response();
   968 	$x     = new WP_Ajax_Response();
   854 	foreach ( $names as $cat_name ) {
   969 	foreach ( $names as $cat_name ) {
   855 		$cat_name = trim($cat_name);
   970 		$cat_name = trim( $cat_name );
   856 		$slug = sanitize_title($cat_name);
   971 		$slug     = sanitize_title( $cat_name );
   857 		if ( '' === $slug )
   972 		if ( '' === $slug ) {
   858 			continue;
   973 			continue;
       
   974 		}
   859 
   975 
   860 		$cat_id = wp_insert_term( $cat_name, 'link_category' );
   976 		$cat_id = wp_insert_term( $cat_name, 'link_category' );
   861 		if ( ! $cat_id || is_wp_error( $cat_id ) ) {
   977 		if ( ! $cat_id || is_wp_error( $cat_id ) ) {
   862 			continue;
   978 			continue;
   863 		} else {
   979 		} else {
   864 			$cat_id = $cat_id['term_id'];
   980 			$cat_id = $cat_id['term_id'];
   865 		}
   981 		}
   866 		$cat_name = esc_html( $cat_name );
   982 		$cat_name = esc_html( $cat_name );
   867 		$x->add( array(
   983 		$x->add(
   868 			'what' => 'link-category',
   984 			array(
   869 			'id' => $cat_id,
   985 				'what'     => 'link-category',
   870 			'data' => "<li id='link-category-$cat_id'><label for='in-link-category-$cat_id' class='selectit'><input value='" . esc_attr($cat_id) . "' type='checkbox' checked='checked' name='link_category[]' id='in-link-category-$cat_id'/> $cat_name</label></li>",
   986 				'id'       => $cat_id,
   871 			'position' => -1
   987 				'data'     => "<li id='link-category-$cat_id'><label for='in-link-category-$cat_id' class='selectit'><input value='" . esc_attr( $cat_id ) . "' type='checkbox' checked='checked' name='link_category[]' id='in-link-category-$cat_id'/> $cat_name</label></li>",
   872 		) );
   988 				'position' => -1,
       
   989 			)
       
   990 		);
   873 	}
   991 	}
   874 	$x->send();
   992 	$x->send();
   875 }
   993 }
   876 
   994 
   877 /**
   995 /**
   879  *
   997  *
   880  * @since 3.1.0
   998  * @since 3.1.0
   881  */
   999  */
   882 function wp_ajax_add_tag() {
  1000 function wp_ajax_add_tag() {
   883 	check_ajax_referer( 'add-tag', '_wpnonce_add-tag' );
  1001 	check_ajax_referer( 'add-tag', '_wpnonce_add-tag' );
   884 	$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
  1002 	$taxonomy = ! empty( $_POST['taxonomy'] ) ? $_POST['taxonomy'] : 'post_tag';
   885 	$tax = get_taxonomy($taxonomy);
  1003 	$tax      = get_taxonomy( $taxonomy );
   886 
  1004 
   887 	if ( !current_user_can( $tax->cap->edit_terms ) )
  1005 	if ( ! current_user_can( $tax->cap->edit_terms ) ) {
   888 		wp_die( -1 );
  1006 		wp_die( -1 );
       
  1007 	}
   889 
  1008 
   890 	$x = new WP_Ajax_Response();
  1009 	$x = new WP_Ajax_Response();
   891 
  1010 
   892 	$tag = wp_insert_term($_POST['tag-name'], $taxonomy, $_POST );
  1011 	$tag = wp_insert_term( $_POST['tag-name'], $taxonomy, $_POST );
   893 
  1012 
   894 	if ( !$tag || is_wp_error($tag) || (!$tag = get_term( $tag['term_id'], $taxonomy )) ) {
  1013 	if ( ! $tag || is_wp_error( $tag ) || ( ! $tag = get_term( $tag['term_id'], $taxonomy ) ) ) {
   895 		$message = __('An error has occurred. Please reload the page and try again.');
  1014 		$message = __( 'An error has occurred. Please reload the page and try again.' );
   896 		if ( is_wp_error($tag) && $tag->get_error_message() )
  1015 		if ( is_wp_error( $tag ) && $tag->get_error_message() ) {
   897 			$message = $tag->get_error_message();
  1016 			$message = $tag->get_error_message();
   898 
  1017 		}
   899 		$x->add( array(
  1018 
   900 			'what' => 'taxonomy',
  1019 		$x->add(
   901 			'data' => new WP_Error('error', $message )
  1020 			array(
   902 		) );
  1021 				'what' => 'taxonomy',
       
  1022 				'data' => new WP_Error( 'error', $message ),
       
  1023 			)
       
  1024 		);
   903 		$x->send();
  1025 		$x->send();
   904 	}
  1026 	}
   905 
  1027 
   906 	$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );
  1028 	$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );
   907 
  1029 
   908 	$level = 0;
  1030 	$level     = 0;
   909 	if ( is_taxonomy_hierarchical($taxonomy) ) {
  1031 	$noparents = '';
       
  1032 
       
  1033 	if ( is_taxonomy_hierarchical( $taxonomy ) ) {
   910 		$level = count( get_ancestors( $tag->term_id, $taxonomy, 'taxonomy' ) );
  1034 		$level = count( get_ancestors( $tag->term_id, $taxonomy, 'taxonomy' ) );
   911 		ob_start();
  1035 		ob_start();
   912 		$wp_list_table->single_row( $tag, $level );
  1036 		$wp_list_table->single_row( $tag, $level );
   913 		$noparents = ob_get_clean();
  1037 		$noparents = ob_get_clean();
   914 	}
  1038 	}
   915 
  1039 
   916 	ob_start();
  1040 	ob_start();
   917 	$wp_list_table->single_row( $tag );
  1041 	$wp_list_table->single_row( $tag );
   918 	$parents = ob_get_clean();
  1042 	$parents = ob_get_clean();
   919 
  1043 
   920 	$x->add( array(
  1044 	$x->add(
   921 		'what' => 'taxonomy',
  1045 		array(
   922 		'supplemental' => compact('parents', 'noparents')
  1046 			'what'         => 'taxonomy',
   923 	) );
  1047 			'supplemental' => compact( 'parents', 'noparents' ),
   924 	$x->add( array(
  1048 		)
   925 		'what' => 'term',
  1049 	);
   926 		'position' => $level,
  1050 	$x->add(
   927 		'supplemental' => (array) $tag
  1051 		array(
   928 	) );
  1052 			'what'         => 'term',
       
  1053 			'position'     => $level,
       
  1054 			'supplemental' => (array) $tag,
       
  1055 		)
       
  1056 	);
   929 	$x->send();
  1057 	$x->send();
   930 }
  1058 }
   931 
  1059 
   932 /**
  1060 /**
   933  * Ajax handler for getting a tagcloud.
  1061  * Ajax handler for getting a tagcloud.
   938 	if ( ! isset( $_POST['tax'] ) ) {
  1066 	if ( ! isset( $_POST['tax'] ) ) {
   939 		wp_die( 0 );
  1067 		wp_die( 0 );
   940 	}
  1068 	}
   941 
  1069 
   942 	$taxonomy = sanitize_key( $_POST['tax'] );
  1070 	$taxonomy = sanitize_key( $_POST['tax'] );
   943 	$tax = get_taxonomy( $taxonomy );
  1071 	$tax      = get_taxonomy( $taxonomy );
   944 	if ( ! $tax ) {
  1072 	if ( ! $tax ) {
   945 		wp_die( 0 );
  1073 		wp_die( 0 );
   946 	}
  1074 	}
   947 
  1075 
   948 	if ( ! current_user_can( $tax->cap->assign_terms ) ) {
  1076 	if ( ! current_user_can( $tax->cap->assign_terms ) ) {
   949 		wp_die( -1 );
  1077 		wp_die( -1 );
   950 	}
  1078 	}
   951 
  1079 
   952 	$tags = get_terms( $taxonomy, array( 'number' => 45, 'orderby' => 'count', 'order' => 'DESC' ) );
  1080 	$tags = get_terms(
   953 
  1081 		$taxonomy,
   954 	if ( empty( $tags ) )
  1082 		array(
       
  1083 			'number'  => 45,
       
  1084 			'orderby' => 'count',
       
  1085 			'order'   => 'DESC',
       
  1086 		)
       
  1087 	);
       
  1088 
       
  1089 	if ( empty( $tags ) ) {
   955 		wp_die( $tax->labels->not_found );
  1090 		wp_die( $tax->labels->not_found );
   956 
  1091 	}
   957 	if ( is_wp_error( $tags ) )
  1092 
       
  1093 	if ( is_wp_error( $tags ) ) {
   958 		wp_die( $tags->get_error_message() );
  1094 		wp_die( $tags->get_error_message() );
       
  1095 	}
   959 
  1096 
   960 	foreach ( $tags as $key => $tag ) {
  1097 	foreach ( $tags as $key => $tag ) {
   961 		$tags[ $key ]->link = '#';
  1098 		$tags[ $key ]->link = '#';
   962 		$tags[ $key ]->id = $tag->term_id;
  1099 		$tags[ $key ]->id   = $tag->term_id;
   963 	}
  1100 	}
   964 
  1101 
   965 	// We need raw tag names here, so don't filter the output
  1102 	// We need raw tag names here, so don't filter the output
   966 	$return = wp_generate_tag_cloud( $tags, array( 'filter' => 0, 'format' => 'list' ) );
  1103 	$return = wp_generate_tag_cloud(
   967 
  1104 		$tags,
   968 	if ( empty($return) )
  1105 		array(
       
  1106 			'filter' => 0,
       
  1107 			'format' => 'list',
       
  1108 		)
       
  1109 	);
       
  1110 
       
  1111 	if ( empty( $return ) ) {
   969 		wp_die( 0 );
  1112 		wp_die( 0 );
       
  1113 	}
   970 
  1114 
   971 	echo $return;
  1115 	echo $return;
   972 
  1116 
   973 	wp_die();
  1117 	wp_die();
   974 }
  1118 }
  1013 	}
  1157 	}
  1014 
  1158 
  1015 	$x = new WP_Ajax_Response();
  1159 	$x = new WP_Ajax_Response();
  1016 	ob_start();
  1160 	ob_start();
  1017 	foreach ( $wp_list_table->items as $comment ) {
  1161 	foreach ( $wp_list_table->items as $comment ) {
  1018 		if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) && 0 === $comment->comment_approved )
  1162 		if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) && 0 === $comment->comment_approved ) {
  1019 			continue;
  1163 			continue;
       
  1164 		}
  1020 		get_comment( $comment );
  1165 		get_comment( $comment );
  1021 		$wp_list_table->single_row( $comment );
  1166 		$wp_list_table->single_row( $comment );
  1022 	}
  1167 	}
  1023 	$comment_list_item = ob_get_clean();
  1168 	$comment_list_item = ob_get_clean();
  1024 
  1169 
  1025 	$x->add( array(
  1170 	$x->add(
  1026 		'what' => 'comments',
  1171 		array(
  1027 		'data' => $comment_list_item
  1172 			'what' => 'comments',
  1028 	) );
  1173 			'data' => $comment_list_item,
       
  1174 		)
       
  1175 	);
  1029 	$x->send();
  1176 	$x->send();
  1030 }
  1177 }
  1031 
  1178 
  1032 /**
  1179 /**
  1033  * Ajax handler for replying to a comment.
  1180  * Ajax handler for replying to a comment.
  1035  * @since 3.1.0
  1182  * @since 3.1.0
  1036  *
  1183  *
  1037  * @param string $action Action to perform.
  1184  * @param string $action Action to perform.
  1038  */
  1185  */
  1039 function wp_ajax_replyto_comment( $action ) {
  1186 function wp_ajax_replyto_comment( $action ) {
  1040 	if ( empty( $action ) )
  1187 	if ( empty( $action ) ) {
  1041 		$action = 'replyto-comment';
  1188 		$action = 'replyto-comment';
       
  1189 	}
  1042 
  1190 
  1043 	check_ajax_referer( $action, '_ajax_nonce-replyto-comment' );
  1191 	check_ajax_referer( $action, '_ajax_nonce-replyto-comment' );
  1044 
  1192 
  1045 	$comment_post_ID = (int) $_POST['comment_post_ID'];
  1193 	$comment_post_ID = (int) $_POST['comment_post_ID'];
  1046 	$post = get_post( $comment_post_ID );
  1194 	$post            = get_post( $comment_post_ID );
  1047 	if ( ! $post )
  1195 	if ( ! $post ) {
  1048 		wp_die( -1 );
  1196 		wp_die( -1 );
  1049 
  1197 	}
  1050 	if ( !current_user_can( 'edit_post', $comment_post_ID ) )
  1198 
       
  1199 	if ( ! current_user_can( 'edit_post', $comment_post_ID ) ) {
  1051 		wp_die( -1 );
  1200 		wp_die( -1 );
  1052 
  1201 	}
  1053 	if ( empty( $post->post_status ) )
  1202 
       
  1203 	if ( empty( $post->post_status ) ) {
  1054 		wp_die( 1 );
  1204 		wp_die( 1 );
  1055 	elseif ( in_array($post->post_status, array('draft', 'pending', 'trash') ) )
  1205 	} elseif ( in_array( $post->post_status, array( 'draft', 'pending', 'trash' ) ) ) {
  1056 		wp_die( __('ERROR: you are replying to a comment on a draft post.') );
  1206 		wp_die( __( 'ERROR: you are replying to a comment on a draft post.' ) );
       
  1207 	}
  1057 
  1208 
  1058 	$user = wp_get_current_user();
  1209 	$user = wp_get_current_user();
  1059 	if ( $user->exists() ) {
  1210 	if ( $user->exists() ) {
  1060 		$user_ID = $user->ID;
  1211 		$user_ID              = $user->ID;
  1061 		$comment_author       = wp_slash( $user->display_name );
  1212 		$comment_author       = wp_slash( $user->display_name );
  1062 		$comment_author_email = wp_slash( $user->user_email );
  1213 		$comment_author_email = wp_slash( $user->user_email );
  1063 		$comment_author_url   = wp_slash( $user->user_url );
  1214 		$comment_author_url   = wp_slash( $user->user_url );
  1064 		$comment_content      = trim( $_POST['content'] );
  1215 		$comment_content      = trim( $_POST['content'] );
  1065 		$comment_type         = isset( $_POST['comment_type'] ) ? trim( $_POST['comment_type'] ) : '';
  1216 		$comment_type         = isset( $_POST['comment_type'] ) ? trim( $_POST['comment_type'] ) : '';
  1066 		if ( current_user_can( 'unfiltered_html' ) ) {
  1217 		if ( current_user_can( 'unfiltered_html' ) ) {
  1067 			if ( ! isset( $_POST['_wp_unfiltered_html_comment'] ) )
  1218 			if ( ! isset( $_POST['_wp_unfiltered_html_comment'] ) ) {
  1068 				$_POST['_wp_unfiltered_html_comment'] = '';
  1219 				$_POST['_wp_unfiltered_html_comment'] = '';
       
  1220 			}
  1069 
  1221 
  1070 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
  1222 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
  1071 				kses_remove_filters(); // start with a clean slate
  1223 				kses_remove_filters(); // start with a clean slate
  1072 				kses_init_filters(); // set up the filters
  1224 				kses_init_filters(); // set up the filters
       
  1225 				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
       
  1226 				add_filter( 'pre_comment_content', 'wp_filter_kses' );
  1073 			}
  1227 			}
  1074 		}
  1228 		}
  1075 	} else {
  1229 	} else {
  1076 		wp_die( __( 'Sorry, you must be logged in to reply to a comment.' ) );
  1230 		wp_die( __( 'Sorry, you must be logged in to reply to a comment.' ) );
  1077 	}
  1231 	}
  1078 
  1232 
  1079 	if ( '' == $comment_content )
  1233 	if ( '' == $comment_content ) {
  1080 		wp_die( __( 'ERROR: please type a comment.' ) );
  1234 		wp_die( __( 'ERROR: please type a comment.' ) );
       
  1235 	}
  1081 
  1236 
  1082 	$comment_parent = 0;
  1237 	$comment_parent = 0;
  1083 	if ( isset( $_POST['comment_ID'] ) )
  1238 	if ( isset( $_POST['comment_ID'] ) ) {
  1084 		$comment_parent = absint( $_POST['comment_ID'] );
  1239 		$comment_parent = absint( $_POST['comment_ID'] );
       
  1240 	}
  1085 	$comment_auto_approved = false;
  1241 	$comment_auto_approved = false;
  1086 	$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');
  1242 	$commentdata           = compact( 'comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID' );
  1087 
  1243 
  1088 	// Automatically approve parent comment.
  1244 	// Automatically approve parent comment.
  1089 	if ( !empty($_POST['approve_parent']) ) {
  1245 	if ( ! empty( $_POST['approve_parent'] ) ) {
  1090 		$parent = get_comment( $comment_parent );
  1246 		$parent = get_comment( $comment_parent );
  1091 
  1247 
  1092 		if ( $parent && $parent->comment_approved === '0' && $parent->comment_post_ID == $comment_post_ID ) {
  1248 		if ( $parent && $parent->comment_approved === '0' && $parent->comment_post_ID == $comment_post_ID ) {
  1093 			if ( ! current_user_can( 'edit_comment', $parent->comment_ID ) ) {
  1249 			if ( ! current_user_can( 'edit_comment', $parent->comment_ID ) ) {
  1094 				wp_die( -1 );
  1250 				wp_die( -1 );
  1095 			}
  1251 			}
  1096 
  1252 
  1097 			if ( wp_set_comment_status( $parent, 'approve' ) )
  1253 			if ( wp_set_comment_status( $parent, 'approve' ) ) {
  1098 				$comment_auto_approved = true;
  1254 				$comment_auto_approved = true;
       
  1255 			}
  1099 		}
  1256 		}
  1100 	}
  1257 	}
  1101 
  1258 
  1102 	$comment_id = wp_new_comment( $commentdata );
  1259 	$comment_id = wp_new_comment( $commentdata );
  1103 
  1260 
  1104 	if ( is_wp_error( $comment_id ) ) {
  1261 	if ( is_wp_error( $comment_id ) ) {
  1105 		wp_die( $comment_id->get_error_message() );
  1262 		wp_die( $comment_id->get_error_message() );
  1106 	}
  1263 	}
  1107 
  1264 
  1108 	$comment = get_comment($comment_id);
  1265 	$comment = get_comment( $comment_id );
  1109 	if ( ! $comment ) wp_die( 1 );
  1266 	if ( ! $comment ) {
  1110 
  1267 		wp_die( 1 );
  1111 	$position = ( isset($_POST['position']) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
  1268 	}
       
  1269 
       
  1270 	$position = ( isset( $_POST['position'] ) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
  1112 
  1271 
  1113 	ob_start();
  1272 	ob_start();
  1114 	if ( isset( $_REQUEST['mode'] ) && 'dashboard' == $_REQUEST['mode'] ) {
  1273 	if ( isset( $_REQUEST['mode'] ) && 'dashboard' == $_REQUEST['mode'] ) {
  1115 		require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
  1274 		require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
  1116 		_wp_dashboard_recent_comments_row( $comment );
  1275 		_wp_dashboard_recent_comments_row( $comment );
  1117 	} else {
  1276 	} else {
  1118 		if ( isset( $_REQUEST['mode'] ) && 'single' == $_REQUEST['mode'] ) {
  1277 		if ( isset( $_REQUEST['mode'] ) && 'single' == $_REQUEST['mode'] ) {
  1119 			$wp_list_table = _get_list_table('WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1278 			$wp_list_table = _get_list_table( 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1120 		} else {
  1279 		} else {
  1121 			$wp_list_table = _get_list_table('WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1280 			$wp_list_table = _get_list_table( 'WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1122 		}
  1281 		}
  1123 		$wp_list_table->single_row( $comment );
  1282 		$wp_list_table->single_row( $comment );
  1124 	}
  1283 	}
  1125 	$comment_list_item = ob_get_clean();
  1284 	$comment_list_item = ob_get_clean();
  1126 
  1285 
  1127 	$response =  array(
  1286 	$response = array(
  1128 		'what' => 'comment',
  1287 		'what'     => 'comment',
  1129 		'id' => $comment->comment_ID,
  1288 		'id'       => $comment->comment_ID,
  1130 		'data' => $comment_list_item,
  1289 		'data'     => $comment_list_item,
  1131 		'position' => $position
  1290 		'position' => $position,
  1132 	);
  1291 	);
  1133 
  1292 
  1134 	$counts = wp_count_comments();
  1293 	$counts                   = wp_count_comments();
  1135 	$response['supplemental'] = array(
  1294 	$response['supplemental'] = array(
  1136 		'in_moderation' => $counts->moderated,
  1295 		'in_moderation'        => $counts->moderated,
  1137 		'i18n_comments_text' => sprintf(
  1296 		'i18n_comments_text'   => sprintf(
       
  1297 			/* translators: %s: number of comments approved */
  1138 			_n( '%s Comment', '%s Comments', $counts->approved ),
  1298 			_n( '%s Comment', '%s Comments', $counts->approved ),
  1139 			number_format_i18n( $counts->approved )
  1299 			number_format_i18n( $counts->approved )
  1140 		),
  1300 		),
  1141 		'i18n_moderation_text' => sprintf(
  1301 		'i18n_moderation_text' => sprintf(
  1142 			_nx( '%s in moderation', '%s in moderation', $counts->moderated, 'comments' ),
  1302 			/* translators: %s: number of comments in moderation */
       
  1303 			_n( '%s Comment in moderation', '%s Comments in moderation', $counts->moderated ),
  1143 			number_format_i18n( $counts->moderated )
  1304 			number_format_i18n( $counts->moderated )
  1144 		)
  1305 		),
  1145 	);
  1306 	);
  1146 
  1307 
  1147 	if ( $comment_auto_approved ) {
  1308 	if ( $comment_auto_approved ) {
  1148 		$response['supplemental']['parent_approved'] = $parent->comment_ID;
  1309 		$response['supplemental']['parent_approved'] = $parent->comment_ID;
  1149 		$response['supplemental']['parent_post_id'] = $parent->comment_post_ID;
  1310 		$response['supplemental']['parent_post_id']  = $parent->comment_post_ID;
  1150 	}
  1311 	}
  1151 
  1312 
  1152 	$x = new WP_Ajax_Response();
  1313 	$x = new WP_Ajax_Response();
  1153 	$x->add( $response );
  1314 	$x->add( $response );
  1154 	$x->send();
  1315 	$x->send();
  1161  */
  1322  */
  1162 function wp_ajax_edit_comment() {
  1323 function wp_ajax_edit_comment() {
  1163 	check_ajax_referer( 'replyto-comment', '_ajax_nonce-replyto-comment' );
  1324 	check_ajax_referer( 'replyto-comment', '_ajax_nonce-replyto-comment' );
  1164 
  1325 
  1165 	$comment_id = (int) $_POST['comment_ID'];
  1326 	$comment_id = (int) $_POST['comment_ID'];
  1166 	if ( ! current_user_can( 'edit_comment', $comment_id ) )
  1327 	if ( ! current_user_can( 'edit_comment', $comment_id ) ) {
  1167 		wp_die( -1 );
  1328 		wp_die( -1 );
  1168 
  1329 	}
  1169 	if ( '' == $_POST['content'] )
  1330 
       
  1331 	if ( '' == $_POST['content'] ) {
  1170 		wp_die( __( 'ERROR: please type a comment.' ) );
  1332 		wp_die( __( 'ERROR: please type a comment.' ) );
  1171 
  1333 	}
  1172 	if ( isset( $_POST['status'] ) )
  1334 
       
  1335 	if ( isset( $_POST['status'] ) ) {
  1173 		$_POST['comment_status'] = $_POST['status'];
  1336 		$_POST['comment_status'] = $_POST['status'];
       
  1337 	}
  1174 	edit_comment();
  1338 	edit_comment();
  1175 
  1339 
  1176 	$position = ( isset($_POST['position']) && (int) $_POST['position']) ? (int) $_POST['position'] : '-1';
  1340 	$position      = ( isset( $_POST['position'] ) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
  1177 	$checkbox = ( isset($_POST['checkbox']) && true == $_POST['checkbox'] ) ? 1 : 0;
  1341 	$checkbox      = ( isset( $_POST['checkbox'] ) && true == $_POST['checkbox'] ) ? 1 : 0;
  1178 	$wp_list_table = _get_list_table( $checkbox ? 'WP_Comments_List_Table' : 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1342 	$wp_list_table = _get_list_table( $checkbox ? 'WP_Comments_List_Table' : 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
  1179 
  1343 
  1180 	$comment = get_comment( $comment_id );
  1344 	$comment = get_comment( $comment_id );
  1181 	if ( empty( $comment->comment_ID ) )
  1345 	if ( empty( $comment->comment_ID ) ) {
  1182 		wp_die( -1 );
  1346 		wp_die( -1 );
       
  1347 	}
  1183 
  1348 
  1184 	ob_start();
  1349 	ob_start();
  1185 	$wp_list_table->single_row( $comment );
  1350 	$wp_list_table->single_row( $comment );
  1186 	$comment_list_item = ob_get_clean();
  1351 	$comment_list_item = ob_get_clean();
  1187 
  1352 
  1188 	$x = new WP_Ajax_Response();
  1353 	$x = new WP_Ajax_Response();
  1189 
  1354 
  1190 	$x->add( array(
  1355 	$x->add(
  1191 		'what' => 'edit_comment',
  1356 		array(
  1192 		'id' => $comment->comment_ID,
  1357 			'what'     => 'edit_comment',
  1193 		'data' => $comment_list_item,
  1358 			'id'       => $comment->comment_ID,
  1194 		'position' => $position
  1359 			'data'     => $comment_list_item,
  1195 	));
  1360 			'position' => $position,
       
  1361 		)
       
  1362 	);
  1196 
  1363 
  1197 	$x->send();
  1364 	$x->send();
  1198 }
  1365 }
  1199 
  1366 
  1200 /**
  1367 /**
  1203  * @since 3.1.0
  1370  * @since 3.1.0
  1204  */
  1371  */
  1205 function wp_ajax_add_menu_item() {
  1372 function wp_ajax_add_menu_item() {
  1206 	check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
  1373 	check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
  1207 
  1374 
  1208 	if ( ! current_user_can( 'edit_theme_options' ) )
  1375 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1209 		wp_die( -1 );
  1376 		wp_die( -1 );
       
  1377 	}
  1210 
  1378 
  1211 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1379 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1212 
  1380 
  1213 	// For performance reasons, we omit some object properties from the checklist.
  1381 	// For performance reasons, we omit some object properties from the checklist.
  1214 	// The following is a hacky way to restore them when adding non-custom items.
  1382 	// The following is a hacky way to restore them when adding non-custom items.
  1218 		if (
  1386 		if (
  1219 			! empty( $menu_item_data['menu-item-type'] ) &&
  1387 			! empty( $menu_item_data['menu-item-type'] ) &&
  1220 			'custom' != $menu_item_data['menu-item-type'] &&
  1388 			'custom' != $menu_item_data['menu-item-type'] &&
  1221 			! empty( $menu_item_data['menu-item-object-id'] )
  1389 			! empty( $menu_item_data['menu-item-object-id'] )
  1222 		) {
  1390 		) {
  1223 			switch( $menu_item_data['menu-item-type'] ) {
  1391 			switch ( $menu_item_data['menu-item-type'] ) {
  1224 				case 'post_type' :
  1392 				case 'post_type':
  1225 					$_object = get_post( $menu_item_data['menu-item-object-id'] );
  1393 					$_object = get_post( $menu_item_data['menu-item-object-id'] );
  1226 				break;
  1394 					break;
  1227 
  1395 
  1228 				case 'post_type_archive' :
  1396 				case 'post_type_archive':
  1229 					$_object = get_post_type_object( $menu_item_data['menu-item-object'] );
  1397 					$_object = get_post_type_object( $menu_item_data['menu-item-object'] );
  1230 				break;
  1398 					break;
  1231 
  1399 
  1232 				case 'taxonomy' :
  1400 				case 'taxonomy':
  1233 					$_object = get_term( $menu_item_data['menu-item-object-id'], $menu_item_data['menu-item-object'] );
  1401 					$_object = get_term( $menu_item_data['menu-item-object-id'], $menu_item_data['menu-item-object'] );
  1234 				break;
  1402 					break;
  1235 			}
  1403 			}
  1236 
  1404 
  1237 			$_menu_items = array_map( 'wp_setup_nav_menu_item', array( $_object ) );
  1405 			$_menu_items = array_map( 'wp_setup_nav_menu_item', array( $_object ) );
  1238 			$_menu_item = reset( $_menu_items );
  1406 			$_menu_item  = reset( $_menu_items );
  1239 
  1407 
  1240 			// Restore the missing menu item properties
  1408 			// Restore the missing menu item properties
  1241 			$menu_item_data['menu-item-description'] = $_menu_item->description;
  1409 			$menu_item_data['menu-item-description'] = $_menu_item->description;
  1242 		}
  1410 		}
  1243 
  1411 
  1244 		$menu_items_data[] = $menu_item_data;
  1412 		$menu_items_data[] = $menu_item_data;
  1245 	}
  1413 	}
  1246 
  1414 
  1247 	$item_ids = wp_save_nav_menu_items( 0, $menu_items_data );
  1415 	$item_ids = wp_save_nav_menu_items( 0, $menu_items_data );
  1248 	if ( is_wp_error( $item_ids ) )
  1416 	if ( is_wp_error( $item_ids ) ) {
  1249 		wp_die( 0 );
  1417 		wp_die( 0 );
       
  1418 	}
  1250 
  1419 
  1251 	$menu_items = array();
  1420 	$menu_items = array();
  1252 
  1421 
  1253 	foreach ( (array) $item_ids as $menu_item_id ) {
  1422 	foreach ( (array) $item_ids as $menu_item_id ) {
  1254 		$menu_obj = get_post( $menu_item_id );
  1423 		$menu_obj = get_post( $menu_item_id );
  1255 		if ( ! empty( $menu_obj->ID ) ) {
  1424 		if ( ! empty( $menu_obj->ID ) ) {
  1256 			$menu_obj = wp_setup_nav_menu_item( $menu_obj );
  1425 			$menu_obj        = wp_setup_nav_menu_item( $menu_obj );
       
  1426 			$menu_obj->title = empty( $menu_obj->title ) ? __( 'Menu Item' ) : $menu_obj->title;
  1257 			$menu_obj->label = $menu_obj->title; // don't show "(pending)" in ajax-added items
  1427 			$menu_obj->label = $menu_obj->title; // don't show "(pending)" in ajax-added items
  1258 			$menu_items[] = $menu_obj;
  1428 			$menu_items[]    = $menu_obj;
  1259 		}
  1429 		}
  1260 	}
  1430 	}
  1261 
  1431 
  1262 	/** This filter is documented in wp-admin/includes/nav-menu.php */
  1432 	/** This filter is documented in wp-admin/includes/nav-menu.php */
  1263 	$walker_class_name = apply_filters( 'wp_edit_nav_menu_walker', 'Walker_Nav_Menu_Edit', $_POST['menu'] );
  1433 	$walker_class_name = apply_filters( 'wp_edit_nav_menu_walker', 'Walker_Nav_Menu_Edit', $_POST['menu'] );
  1264 
  1434 
  1265 	if ( ! class_exists( $walker_class_name ) )
  1435 	if ( ! class_exists( $walker_class_name ) ) {
  1266 		wp_die( 0 );
  1436 		wp_die( 0 );
       
  1437 	}
  1267 
  1438 
  1268 	if ( ! empty( $menu_items ) ) {
  1439 	if ( ! empty( $menu_items ) ) {
  1269 		$args = array(
  1440 		$args = array(
  1270 			'after' => '',
  1441 			'after'       => '',
  1271 			'before' => '',
  1442 			'before'      => '',
  1272 			'link_after' => '',
  1443 			'link_after'  => '',
  1273 			'link_before' => '',
  1444 			'link_before' => '',
  1274 			'walker' => new $walker_class_name,
  1445 			'walker'      => new $walker_class_name,
  1275 		);
  1446 		);
  1276 		echo walk_nav_menu_tree( $menu_items, 0, (object) $args );
  1447 		echo walk_nav_menu_tree( $menu_items, 0, (object) $args );
  1277 	}
  1448 	}
  1278 	wp_die();
  1449 	wp_die();
  1279 }
  1450 }
  1283  *
  1454  *
  1284  * @since 3.1.0
  1455  * @since 3.1.0
  1285  */
  1456  */
  1286 function wp_ajax_add_meta() {
  1457 function wp_ajax_add_meta() {
  1287 	check_ajax_referer( 'add-meta', '_ajax_nonce-add-meta' );
  1458 	check_ajax_referer( 'add-meta', '_ajax_nonce-add-meta' );
  1288 	$c = 0;
  1459 	$c    = 0;
  1289 	$pid = (int) $_POST['post_id'];
  1460 	$pid  = (int) $_POST['post_id'];
  1290 	$post = get_post( $pid );
  1461 	$post = get_post( $pid );
  1291 
  1462 
  1292 	if ( isset($_POST['metakeyselect']) || isset($_POST['metakeyinput']) ) {
  1463 	if ( isset( $_POST['metakeyselect'] ) || isset( $_POST['metakeyinput'] ) ) {
  1293 		if ( !current_user_can( 'edit_post', $pid ) )
  1464 		if ( ! current_user_can( 'edit_post', $pid ) ) {
  1294 			wp_die( -1 );
  1465 			wp_die( -1 );
  1295 		if ( isset($_POST['metakeyselect']) && '#NONE#' == $_POST['metakeyselect'] && empty($_POST['metakeyinput']) )
  1466 		}
       
  1467 		if ( isset( $_POST['metakeyselect'] ) && '#NONE#' == $_POST['metakeyselect'] && empty( $_POST['metakeyinput'] ) ) {
  1296 			wp_die( 1 );
  1468 			wp_die( 1 );
       
  1469 		}
  1297 
  1470 
  1298 		// If the post is an autodraft, save the post as a draft and then attempt to save the meta.
  1471 		// If the post is an autodraft, save the post as a draft and then attempt to save the meta.
  1299 		if ( $post->post_status == 'auto-draft' ) {
  1472 		if ( $post->post_status == 'auto-draft' ) {
  1300 			$post_data = array();
  1473 			$post_data                = array();
  1301 			$post_data['action'] = 'draft'; // Warning fix
  1474 			$post_data['action']      = 'draft'; // Warning fix
  1302 			$post_data['post_ID'] = $pid;
  1475 			$post_data['post_ID']     = $pid;
  1303 			$post_data['post_type'] = $post->post_type;
  1476 			$post_data['post_type']   = $post->post_type;
  1304 			$post_data['post_status'] = 'draft';
  1477 			$post_data['post_status'] = 'draft';
  1305 			$now = current_time('timestamp', 1);
  1478 			$now                      = time();
  1306 			/* translators: 1: Post creation date, 2: Post creation time */
  1479 			/* translators: 1: Post creation date, 2: Post creation time */
  1307 			$post_data['post_title'] = sprintf( __( 'Draft created on %1$s at %2$s' ), date( __( 'F j, Y' ), $now ), date( __( 'g:i a' ), $now ) );
  1480 			$post_data['post_title'] = sprintf( __( 'Draft created on %1$s at %2$s' ), date( __( 'F j, Y' ), $now ), date( __( 'g:i a' ), $now ) );
  1308 
  1481 
  1309 			$pid = edit_post( $post_data );
  1482 			$pid = edit_post( $post_data );
  1310 			if ( $pid ) {
  1483 			if ( $pid ) {
  1311 				if ( is_wp_error( $pid ) ) {
  1484 				if ( is_wp_error( $pid ) ) {
  1312 					$x = new WP_Ajax_Response( array(
  1485 					$x = new WP_Ajax_Response(
  1313 						'what' => 'meta',
  1486 						array(
  1314 						'data' => $pid
  1487 							'what' => 'meta',
  1315 					) );
  1488 							'data' => $pid,
       
  1489 						)
       
  1490 					);
  1316 					$x->send();
  1491 					$x->send();
  1317 				}
  1492 				}
  1318 
  1493 
  1319 				if ( !$mid = add_meta( $pid ) )
  1494 				if ( ! $mid = add_meta( $pid ) ) {
  1320 					wp_die( __( 'Please provide a custom field value.' ) );
  1495 					wp_die( __( 'Please provide a custom field value.' ) );
       
  1496 				}
  1321 			} else {
  1497 			} else {
  1322 				wp_die( 0 );
  1498 				wp_die( 0 );
  1323 			}
  1499 			}
  1324 		} elseif ( ! $mid = add_meta( $pid ) ) {
  1500 		} elseif ( ! $mid = add_meta( $pid ) ) {
  1325 			wp_die( __( 'Please provide a custom field value.' ) );
  1501 			wp_die( __( 'Please provide a custom field value.' ) );
  1326 		}
  1502 		}
  1327 
  1503 
  1328 		$meta = get_metadata_by_mid( 'post', $mid );
  1504 		$meta = get_metadata_by_mid( 'post', $mid );
  1329 		$pid = (int) $meta->post_id;
  1505 		$pid  = (int) $meta->post_id;
  1330 		$meta = get_object_vars( $meta );
  1506 		$meta = get_object_vars( $meta );
  1331 		$x = new WP_Ajax_Response( array(
  1507 		$x    = new WP_Ajax_Response(
  1332 			'what' => 'meta',
  1508 			array(
  1333 			'id' => $mid,
  1509 				'what'         => 'meta',
  1334 			'data' => _list_meta_row( $meta, $c ),
  1510 				'id'           => $mid,
  1335 			'position' => 1,
  1511 				'data'         => _list_meta_row( $meta, $c ),
  1336 			'supplemental' => array('postid' => $pid)
  1512 				'position'     => 1,
  1337 		) );
  1513 				'supplemental' => array( 'postid' => $pid ),
       
  1514 			)
       
  1515 		);
  1338 	} else { // Update?
  1516 	} else { // Update?
  1339 		$mid = (int) key( $_POST['meta'] );
  1517 		$mid   = (int) key( $_POST['meta'] );
  1340 		$key = wp_unslash( $_POST['meta'][$mid]['key'] );
  1518 		$key   = wp_unslash( $_POST['meta'][ $mid ]['key'] );
  1341 		$value = wp_unslash( $_POST['meta'][$mid]['value'] );
  1519 		$value = wp_unslash( $_POST['meta'][ $mid ]['value'] );
  1342 		if ( '' == trim($key) )
  1520 		if ( '' == trim( $key ) ) {
  1343 			wp_die( __( 'Please provide a custom field name.' ) );
  1521 			wp_die( __( 'Please provide a custom field name.' ) );
  1344 		if ( '' == trim($value) )
  1522 		}
  1345 			wp_die( __( 'Please provide a custom field value.' ) );
  1523 		if ( ! $meta = get_metadata_by_mid( 'post', $mid ) ) {
  1346 		if ( ! $meta = get_metadata_by_mid( 'post', $mid ) )
       
  1347 			wp_die( 0 ); // if meta doesn't exist
  1524 			wp_die( 0 ); // if meta doesn't exist
       
  1525 		}
  1348 		if ( is_protected_meta( $meta->meta_key, 'post' ) || is_protected_meta( $key, 'post' ) ||
  1526 		if ( is_protected_meta( $meta->meta_key, 'post' ) || is_protected_meta( $key, 'post' ) ||
  1349 			! current_user_can( 'edit_post_meta', $meta->post_id, $meta->meta_key ) ||
  1527 			! current_user_can( 'edit_post_meta', $meta->post_id, $meta->meta_key ) ||
  1350 			! current_user_can( 'edit_post_meta', $meta->post_id, $key ) )
  1528 			! current_user_can( 'edit_post_meta', $meta->post_id, $key ) ) {
  1351 			wp_die( -1 );
  1529 			wp_die( -1 );
       
  1530 		}
  1352 		if ( $meta->meta_value != $value || $meta->meta_key != $key ) {
  1531 		if ( $meta->meta_value != $value || $meta->meta_key != $key ) {
  1353 			if ( !$u = update_metadata_by_mid( 'post', $mid, $value, $key ) )
  1532 			if ( ! $u = update_metadata_by_mid( 'post', $mid, $value, $key ) ) {
  1354 				wp_die( 0 ); // We know meta exists; we also know it's unchanged (or DB error, in which case there are bigger problems).
  1533 				wp_die( 0 ); // We know meta exists; we also know it's unchanged (or DB error, in which case there are bigger problems).
  1355 		}
  1534 			}
  1356 
  1535 		}
  1357 		$x = new WP_Ajax_Response( array(
  1536 
  1358 			'what' => 'meta',
  1537 		$x = new WP_Ajax_Response(
  1359 			'id' => $mid, 'old_id' => $mid,
  1538 			array(
  1360 			'data' => _list_meta_row( array(
  1539 				'what'         => 'meta',
  1361 				'meta_key' => $key,
  1540 				'id'           => $mid,
  1362 				'meta_value' => $value,
  1541 				'old_id'       => $mid,
  1363 				'meta_id' => $mid
  1542 				'data'         => _list_meta_row(
  1364 			), $c ),
  1543 					array(
  1365 			'position' => 0,
  1544 						'meta_key'   => $key,
  1366 			'supplemental' => array('postid' => $meta->post_id)
  1545 						'meta_value' => $value,
  1367 		) );
  1546 						'meta_id'    => $mid,
       
  1547 					),
       
  1548 					$c
       
  1549 				),
       
  1550 				'position'     => 0,
       
  1551 				'supplemental' => array( 'postid' => $meta->post_id ),
       
  1552 			)
       
  1553 		);
  1368 	}
  1554 	}
  1369 	$x->send();
  1555 	$x->send();
  1370 }
  1556 }
  1371 
  1557 
  1372 /**
  1558 /**
  1380 	if ( empty( $action ) ) {
  1566 	if ( empty( $action ) ) {
  1381 		$action = 'add-user';
  1567 		$action = 'add-user';
  1382 	}
  1568 	}
  1383 
  1569 
  1384 	check_ajax_referer( $action );
  1570 	check_ajax_referer( $action );
  1385 	if ( ! current_user_can('create_users') )
  1571 	if ( ! current_user_can( 'create_users' ) ) {
  1386 		wp_die( -1 );
  1572 		wp_die( -1 );
       
  1573 	}
  1387 	if ( ! $user_id = edit_user() ) {
  1574 	if ( ! $user_id = edit_user() ) {
  1388 		wp_die( 0 );
  1575 		wp_die( 0 );
  1389 	} elseif ( is_wp_error( $user_id ) ) {
  1576 	} elseif ( is_wp_error( $user_id ) ) {
  1390 		$x = new WP_Ajax_Response( array(
  1577 		$x = new WP_Ajax_Response(
  1391 			'what' => 'user',
  1578 			array(
  1392 			'id' => $user_id
  1579 				'what' => 'user',
  1393 		) );
  1580 				'id'   => $user_id,
       
  1581 			)
       
  1582 		);
  1394 		$x->send();
  1583 		$x->send();
  1395 	}
  1584 	}
  1396 	$user_object = get_userdata( $user_id );
  1585 	$user_object = get_userdata( $user_id );
  1397 
  1586 
  1398 	$wp_list_table = _get_list_table('WP_Users_List_Table');
  1587 	$wp_list_table = _get_list_table( 'WP_Users_List_Table' );
  1399 
  1588 
  1400 	$role = current( $user_object->roles );
  1589 	$role = current( $user_object->roles );
  1401 
  1590 
  1402 	$x = new WP_Ajax_Response( array(
  1591 	$x = new WP_Ajax_Response(
  1403 		'what' => 'user',
  1592 		array(
  1404 		'id' => $user_id,
  1593 			'what'         => 'user',
  1405 		'data' => $wp_list_table->single_row( $user_object, '', $role ),
  1594 			'id'           => $user_id,
  1406 		'supplemental' => array(
  1595 			'data'         => $wp_list_table->single_row( $user_object, '', $role ),
  1407 			'show-link' => sprintf(
  1596 			'supplemental' => array(
  1408 				/* translators: %s: the new user */
  1597 				'show-link' => sprintf(
  1409 				__( 'User %s added' ),
  1598 					/* translators: %s: the new user */
  1410 				'<a href="#user-' . $user_id . '">' . $user_object->user_login . '</a>'
  1599 					__( 'User %s added' ),
       
  1600 					'<a href="#user-' . $user_id . '">' . $user_object->user_login . '</a>'
       
  1601 				),
       
  1602 				'role'      => $role,
  1411 			),
  1603 			),
  1412 			'role' => $role,
       
  1413 		)
  1604 		)
  1414 	) );
  1605 	);
  1415 	$x->send();
  1606 	$x->send();
  1416 }
  1607 }
  1417 
  1608 
  1418 /**
  1609 /**
  1419  * Ajax handler for closed post boxes.
  1610  * Ajax handler for closed post boxes.
  1420  *
  1611  *
  1421  * @since 3.1.0
  1612  * @since 3.1.0
  1422  */
  1613  */
  1423 function wp_ajax_closed_postboxes() {
  1614 function wp_ajax_closed_postboxes() {
  1424 	check_ajax_referer( 'closedpostboxes', 'closedpostboxesnonce' );
  1615 	check_ajax_referer( 'closedpostboxes', 'closedpostboxesnonce' );
  1425 	$closed = isset( $_POST['closed'] ) ? explode( ',', $_POST['closed']) : array();
  1616 	$closed = isset( $_POST['closed'] ) ? explode( ',', $_POST['closed'] ) : array();
  1426 	$closed = array_filter($closed);
  1617 	$closed = array_filter( $closed );
  1427 
  1618 
  1428 	$hidden = isset( $_POST['hidden'] ) ? explode( ',', $_POST['hidden']) : array();
  1619 	$hidden = isset( $_POST['hidden'] ) ? explode( ',', $_POST['hidden'] ) : array();
  1429 	$hidden = array_filter($hidden);
  1620 	$hidden = array_filter( $hidden );
  1430 
  1621 
  1431 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1622 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1432 
  1623 
  1433 	if ( $page != sanitize_key( $page ) )
  1624 	if ( $page != sanitize_key( $page ) ) {
  1434 		wp_die( 0 );
  1625 		wp_die( 0 );
  1435 
  1626 	}
  1436 	if ( ! $user = wp_get_current_user() )
  1627 
       
  1628 	if ( ! $user = wp_get_current_user() ) {
  1437 		wp_die( -1 );
  1629 		wp_die( -1 );
  1438 
  1630 	}
  1439 	if ( is_array($closed) )
  1631 
  1440 		update_user_option($user->ID, "closedpostboxes_$page", $closed, true);
  1632 	if ( is_array( $closed ) ) {
  1441 
  1633 		update_user_option( $user->ID, "closedpostboxes_$page", $closed, true );
  1442 	if ( is_array($hidden) ) {
  1634 	}
  1443 		$hidden = array_diff( $hidden, array('submitdiv', 'linksubmitdiv', 'manage-menu', 'create-menu') ); // postboxes that are always shown
  1635 
  1444 		update_user_option($user->ID, "metaboxhidden_$page", $hidden, true);
  1636 	if ( is_array( $hidden ) ) {
       
  1637 		$hidden = array_diff( $hidden, array( 'submitdiv', 'linksubmitdiv', 'manage-menu', 'create-menu' ) ); // postboxes that are always shown
       
  1638 		update_user_option( $user->ID, "metaboxhidden_$page", $hidden, true );
  1445 	}
  1639 	}
  1446 
  1640 
  1447 	wp_die( 1 );
  1641 	wp_die( 1 );
  1448 }
  1642 }
  1449 
  1643 
  1454  */
  1648  */
  1455 function wp_ajax_hidden_columns() {
  1649 function wp_ajax_hidden_columns() {
  1456 	check_ajax_referer( 'screen-options-nonce', 'screenoptionnonce' );
  1650 	check_ajax_referer( 'screen-options-nonce', 'screenoptionnonce' );
  1457 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1651 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1458 
  1652 
  1459 	if ( $page != sanitize_key( $page ) )
  1653 	if ( $page != sanitize_key( $page ) ) {
  1460 		wp_die( 0 );
  1654 		wp_die( 0 );
  1461 
  1655 	}
  1462 	if ( ! $user = wp_get_current_user() )
  1656 
       
  1657 	if ( ! $user = wp_get_current_user() ) {
  1463 		wp_die( -1 );
  1658 		wp_die( -1 );
       
  1659 	}
  1464 
  1660 
  1465 	$hidden = ! empty( $_POST['hidden'] ) ? explode( ',', $_POST['hidden'] ) : array();
  1661 	$hidden = ! empty( $_POST['hidden'] ) ? explode( ',', $_POST['hidden'] ) : array();
  1466 	update_user_option( $user->ID, "manage{$page}columnshidden", $hidden, true );
  1662 	update_user_option( $user->ID, "manage{$page}columnshidden", $hidden, true );
  1467 
  1663 
  1468 	wp_die( 1 );
  1664 	wp_die( 1 );
  1474  * @since 3.1.0
  1670  * @since 3.1.0
  1475  */
  1671  */
  1476 function wp_ajax_update_welcome_panel() {
  1672 function wp_ajax_update_welcome_panel() {
  1477 	check_ajax_referer( 'welcome-panel-nonce', 'welcomepanelnonce' );
  1673 	check_ajax_referer( 'welcome-panel-nonce', 'welcomepanelnonce' );
  1478 
  1674 
  1479 	if ( ! current_user_can( 'edit_theme_options' ) )
  1675 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1480 		wp_die( -1 );
  1676 		wp_die( -1 );
       
  1677 	}
  1481 
  1678 
  1482 	update_user_meta( get_current_user_id(), 'show_welcome_panel', empty( $_POST['visible'] ) ? 0 : 1 );
  1679 	update_user_meta( get_current_user_id(), 'show_welcome_panel', empty( $_POST['visible'] ) ? 0 : 1 );
  1483 
  1680 
  1484 	wp_die( 1 );
  1681 	wp_die( 1 );
  1485 }
  1682 }
  1486 
  1683 
  1487 /**
  1684 /**
  1488  * Ajax handler for updating whether to display the Try Gutenberg panel.
       
  1489  *
       
  1490  * @since 4.9.8
       
  1491  */
       
  1492 function wp_ajax_update_try_gutenberg_panel() {
       
  1493 	check_ajax_referer( 'try-gutenberg-panel-nonce', 'trygutenbergpanelnonce' );
       
  1494 
       
  1495 	update_user_meta( get_current_user_id(), 'show_try_gutenberg_panel', empty( $_POST['visible'] ) ? 0 : 1 );
       
  1496 
       
  1497 	wp_die( 1 );
       
  1498 }
       
  1499 
       
  1500 /**
       
  1501  * Ajax handler for retrieving menu meta boxes.
  1685  * Ajax handler for retrieving menu meta boxes.
  1502  *
  1686  *
  1503  * @since 3.1.0
  1687  * @since 3.1.0
  1504  */
  1688  */
  1505 function wp_ajax_menu_get_metabox() {
  1689 function wp_ajax_menu_get_metabox() {
  1506 	if ( ! current_user_can( 'edit_theme_options' ) )
  1690 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1507 		wp_die( -1 );
  1691 		wp_die( -1 );
       
  1692 	}
  1508 
  1693 
  1509 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1694 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1510 
  1695 
  1511 	if ( isset( $_POST['item-type'] ) && 'post_type' == $_POST['item-type'] ) {
  1696 	if ( isset( $_POST['item-type'] ) && 'post_type' == $_POST['item-type'] ) {
  1512 		$type = 'posttype';
  1697 		$type     = 'posttype';
  1513 		$callback = 'wp_nav_menu_item_post_type_meta_box';
  1698 		$callback = 'wp_nav_menu_item_post_type_meta_box';
  1514 		$items = (array) get_post_types( array( 'show_in_nav_menus' => true ), 'object' );
  1699 		$items    = (array) get_post_types( array( 'show_in_nav_menus' => true ), 'object' );
  1515 	} elseif ( isset( $_POST['item-type'] ) && 'taxonomy' == $_POST['item-type'] ) {
  1700 	} elseif ( isset( $_POST['item-type'] ) && 'taxonomy' == $_POST['item-type'] ) {
  1516 		$type = 'taxonomy';
  1701 		$type     = 'taxonomy';
  1517 		$callback = 'wp_nav_menu_item_taxonomy_meta_box';
  1702 		$callback = 'wp_nav_menu_item_taxonomy_meta_box';
  1518 		$items = (array) get_taxonomies( array( 'show_ui' => true ), 'object' );
  1703 		$items    = (array) get_taxonomies( array( 'show_ui' => true ), 'object' );
  1519 	}
  1704 	}
  1520 
  1705 
  1521 	if ( ! empty( $_POST['item-object'] ) && isset( $items[$_POST['item-object']] ) ) {
  1706 	if ( ! empty( $_POST['item-object'] ) && isset( $items[ $_POST['item-object'] ] ) ) {
  1522 		$menus_meta_box_object = $items[ $_POST['item-object'] ];
  1707 		$menus_meta_box_object = $items[ $_POST['item-object'] ];
  1523 
  1708 
  1524 		/** This filter is documented in wp-admin/includes/nav-menu.php */
  1709 		/** This filter is documented in wp-admin/includes/nav-menu.php */
  1525 		$item = apply_filters( 'nav_menu_meta_box_object', $menus_meta_box_object );
  1710 		$item = apply_filters( 'nav_menu_meta_box_object', $menus_meta_box_object );
  1526 		ob_start();
  1711 		ob_start();
  1527 		call_user_func_array($callback, array(
  1712 		call_user_func_array(
  1528 			null,
  1713 			$callback,
  1529 			array(
  1714 			array(
  1530 				'id' => 'add-' . $item->name,
  1715 				null,
  1531 				'title' => $item->labels->name,
  1716 				array(
  1532 				'callback' => $callback,
  1717 					'id'       => 'add-' . $item->name,
  1533 				'args' => $item,
  1718 					'title'    => $item->labels->name,
       
  1719 					'callback' => $callback,
       
  1720 					'args'     => $item,
       
  1721 				),
  1534 			)
  1722 			)
  1535 		));
  1723 		);
  1536 
  1724 
  1537 		$markup = ob_get_clean();
  1725 		$markup = ob_get_clean();
  1538 
  1726 
  1539 		echo wp_json_encode(array(
  1727 		echo wp_json_encode(
  1540 			'replace-id' => $type . '-' . $item->name,
  1728 			array(
  1541 			'markup' => $markup,
  1729 				'replace-id' => $type . '-' . $item->name,
  1542 		));
  1730 				'markup'     => $markup,
       
  1731 			)
       
  1732 		);
  1543 	}
  1733 	}
  1544 
  1734 
  1545 	wp_die();
  1735 	wp_die();
  1546 }
  1736 }
  1547 
  1737 
  1569 		require( ABSPATH . WPINC . '/class-wp-editor.php' );
  1759 		require( ABSPATH . WPINC . '/class-wp-editor.php' );
  1570 	}
  1760 	}
  1571 
  1761 
  1572 	$results = _WP_Editors::wp_link_query( $args );
  1762 	$results = _WP_Editors::wp_link_query( $args );
  1573 
  1763 
  1574 	if ( ! isset( $results ) )
  1764 	if ( ! isset( $results ) ) {
  1575 		wp_die( 0 );
  1765 		wp_die( 0 );
       
  1766 	}
  1576 
  1767 
  1577 	echo wp_json_encode( $results );
  1768 	echo wp_json_encode( $results );
  1578 	echo "\n";
  1769 	echo "\n";
  1579 
  1770 
  1580 	wp_die();
  1771 	wp_die();
  1584  * Ajax handler for menu locations save.
  1775  * Ajax handler for menu locations save.
  1585  *
  1776  *
  1586  * @since 3.1.0
  1777  * @since 3.1.0
  1587  */
  1778  */
  1588 function wp_ajax_menu_locations_save() {
  1779 function wp_ajax_menu_locations_save() {
  1589 	if ( ! current_user_can( 'edit_theme_options' ) )
  1780 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1590 		wp_die( -1 );
  1781 		wp_die( -1 );
       
  1782 	}
  1591 	check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
  1783 	check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
  1592 	if ( ! isset( $_POST['menu-locations'] ) )
  1784 	if ( ! isset( $_POST['menu-locations'] ) ) {
  1593 		wp_die( 0 );
  1785 		wp_die( 0 );
       
  1786 	}
  1594 	set_theme_mod( 'nav_menu_locations', array_map( 'absint', $_POST['menu-locations'] ) );
  1787 	set_theme_mod( 'nav_menu_locations', array_map( 'absint', $_POST['menu-locations'] ) );
  1595 	wp_die( 1 );
  1788 	wp_die( 1 );
  1596 }
  1789 }
  1597 
  1790 
  1598 /**
  1791 /**
  1600  *
  1793  *
  1601  * @since 3.1.0
  1794  * @since 3.1.0
  1602  */
  1795  */
  1603 function wp_ajax_meta_box_order() {
  1796 function wp_ajax_meta_box_order() {
  1604 	check_ajax_referer( 'meta-box-order' );
  1797 	check_ajax_referer( 'meta-box-order' );
  1605 	$order = isset( $_POST['order'] ) ? (array) $_POST['order'] : false;
  1798 	$order        = isset( $_POST['order'] ) ? (array) $_POST['order'] : false;
  1606 	$page_columns = isset( $_POST['page_columns'] ) ? $_POST['page_columns'] : 'auto';
  1799 	$page_columns = isset( $_POST['page_columns'] ) ? $_POST['page_columns'] : 'auto';
  1607 
  1800 
  1608 	if ( $page_columns != 'auto' )
  1801 	if ( $page_columns != 'auto' ) {
  1609 		$page_columns = (int) $page_columns;
  1802 		$page_columns = (int) $page_columns;
       
  1803 	}
  1610 
  1804 
  1611 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1805 	$page = isset( $_POST['page'] ) ? $_POST['page'] : '';
  1612 
  1806 
  1613 	if ( $page != sanitize_key( $page ) )
  1807 	if ( $page != sanitize_key( $page ) ) {
  1614 		wp_die( 0 );
  1808 		wp_die( 0 );
  1615 
  1809 	}
  1616 	if ( ! $user = wp_get_current_user() )
  1810 
       
  1811 	if ( ! $user = wp_get_current_user() ) {
  1617 		wp_die( -1 );
  1812 		wp_die( -1 );
  1618 
  1813 	}
  1619 	if ( $order )
  1814 
  1620 		update_user_option($user->ID, "meta-box-order_$page", $order, true);
  1815 	if ( $order ) {
  1621 
  1816 		update_user_option( $user->ID, "meta-box-order_$page", $order, true );
  1622 	if ( $page_columns )
  1817 	}
  1623 		update_user_option($user->ID, "screen_layout_$page", $page_columns, true);
  1818 
       
  1819 	if ( $page_columns ) {
       
  1820 		update_user_option( $user->ID, "screen_layout_$page", $page_columns, true );
       
  1821 	}
  1624 
  1822 
  1625 	wp_die( 1 );
  1823 	wp_die( 1 );
  1626 }
  1824 }
  1627 
  1825 
  1628 /**
  1826 /**
  1629  * Ajax handler for menu quick searching.
  1827  * Ajax handler for menu quick searching.
  1630  *
  1828  *
  1631  * @since 3.1.0
  1829  * @since 3.1.0
  1632  */
  1830  */
  1633 function wp_ajax_menu_quick_search() {
  1831 function wp_ajax_menu_quick_search() {
  1634 	if ( ! current_user_can( 'edit_theme_options' ) )
  1832 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1635 		wp_die( -1 );
  1833 		wp_die( -1 );
       
  1834 	}
  1636 
  1835 
  1637 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1836 	require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
  1638 
  1837 
  1639 	_wp_ajax_menu_quick_search( $_POST );
  1838 	_wp_ajax_menu_quick_search( $_POST );
  1640 
  1839 
  1646  *
  1845  *
  1647  * @since 3.1.0
  1846  * @since 3.1.0
  1648  */
  1847  */
  1649 function wp_ajax_get_permalink() {
  1848 function wp_ajax_get_permalink() {
  1650 	check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
  1849 	check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
  1651 	$post_id = isset($_POST['post_id'])? intval($_POST['post_id']) : 0;
  1850 	$post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
  1652 	wp_die( get_preview_post_link( $post_id ) );
  1851 	wp_die( get_preview_post_link( $post_id ) );
  1653 }
  1852 }
  1654 
  1853 
  1655 /**
  1854 /**
  1656  * Ajax handler to retrieve a sample permalink.
  1855  * Ajax handler to retrieve a sample permalink.
  1657  *
  1856  *
  1658  * @since 3.1.0
  1857  * @since 3.1.0
  1659  */
  1858  */
  1660 function wp_ajax_sample_permalink() {
  1859 function wp_ajax_sample_permalink() {
  1661 	check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
  1860 	check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
  1662 	$post_id = isset($_POST['post_id'])? intval($_POST['post_id']) : 0;
  1861 	$post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
  1663 	$title = isset($_POST['new_title'])? $_POST['new_title'] : '';
  1862 	$title   = isset( $_POST['new_title'] ) ? $_POST['new_title'] : '';
  1664 	$slug = isset($_POST['new_slug'])? $_POST['new_slug'] : null;
  1863 	$slug    = isset( $_POST['new_slug'] ) ? $_POST['new_slug'] : null;
  1665 	wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
  1864 	wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
  1666 }
  1865 }
  1667 
  1866 
  1668 /**
  1867 /**
  1669  * Ajax handler for Quick Edit saving a post from a list table.
  1868  * Ajax handler for Quick Edit saving a post from a list table.
  1675 function wp_ajax_inline_save() {
  1874 function wp_ajax_inline_save() {
  1676 	global $mode;
  1875 	global $mode;
  1677 
  1876 
  1678 	check_ajax_referer( 'inlineeditnonce', '_inline_edit' );
  1877 	check_ajax_referer( 'inlineeditnonce', '_inline_edit' );
  1679 
  1878 
  1680 	if ( ! isset($_POST['post_ID']) || ! ( $post_ID = (int) $_POST['post_ID'] ) )
  1879 	if ( ! isset( $_POST['post_ID'] ) || ! ( $post_ID = (int) $_POST['post_ID'] ) ) {
  1681 		wp_die();
  1880 		wp_die();
       
  1881 	}
  1682 
  1882 
  1683 	if ( 'page' == $_POST['post_type'] ) {
  1883 	if ( 'page' == $_POST['post_type'] ) {
  1684 		if ( ! current_user_can( 'edit_page', $post_ID ) )
  1884 		if ( ! current_user_can( 'edit_page', $post_ID ) ) {
  1685 			wp_die( __( 'Sorry, you are not allowed to edit this page.' ) );
  1885 			wp_die( __( 'Sorry, you are not allowed to edit this page.' ) );
       
  1886 		}
  1686 	} else {
  1887 	} else {
  1687 		if ( ! current_user_can( 'edit_post', $post_ID ) )
  1888 		if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  1688 			wp_die( __( 'Sorry, you are not allowed to edit this post.' ) );
  1889 			wp_die( __( 'Sorry, you are not allowed to edit this post.' ) );
       
  1890 		}
  1689 	}
  1891 	}
  1690 
  1892 
  1691 	if ( $last = wp_check_post_lock( $post_ID ) ) {
  1893 	if ( $last = wp_check_post_lock( $post_ID ) ) {
  1692 		$last_user = get_userdata( $last );
  1894 		$last_user      = get_userdata( $last );
  1693 		$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
  1895 		$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
  1694 		printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ),	esc_html( $last_user_name ) );
  1896 
       
  1897 		/* translators: %s: user who is currently editing the post */
       
  1898 		$msg_template = __( 'Saving is disabled: %s is currently editing this post.' );
       
  1899 		if ( $_POST['post_type'] == 'page' ) {
       
  1900 			/* translators: %s: user who is currently editing the page */
       
  1901 			$msg_template = __( 'Saving is disabled: %s is currently editing this page.' );
       
  1902 		}
       
  1903 
       
  1904 		printf( $msg_template, esc_html( $last_user_name ) );
  1695 		wp_die();
  1905 		wp_die();
  1696 	}
  1906 	}
  1697 
  1907 
  1698 	$data = &$_POST;
  1908 	$data = &$_POST;
  1699 
  1909 
  1700 	$post = get_post( $post_ID, ARRAY_A );
  1910 	$post = get_post( $post_ID, ARRAY_A );
  1701 
  1911 
  1702 	// Since it's coming from the database.
  1912 	// Since it's coming from the database.
  1703 	$post = wp_slash($post);
  1913 	$post = wp_slash( $post );
  1704 
  1914 
  1705 	$data['content'] = $post['post_content'];
  1915 	$data['content'] = $post['post_content'];
  1706 	$data['excerpt'] = $post['post_excerpt'];
  1916 	$data['excerpt'] = $post['post_excerpt'];
  1707 
  1917 
  1708 	// Rename.
  1918 	// Rename.
  1709 	$data['user_ID'] = get_current_user_id();
  1919 	$data['user_ID'] = get_current_user_id();
  1710 
  1920 
  1711 	if ( isset($data['post_parent']) )
  1921 	if ( isset( $data['post_parent'] ) ) {
  1712 		$data['parent_id'] = $data['post_parent'];
  1922 		$data['parent_id'] = $data['post_parent'];
       
  1923 	}
  1713 
  1924 
  1714 	// Status.
  1925 	// Status.
  1715 	if ( isset( $data['keep_private'] ) && 'private' == $data['keep_private'] ) {
  1926 	if ( isset( $data['keep_private'] ) && 'private' == $data['keep_private'] ) {
  1716 		$data['visibility']  = 'private';
  1927 		$data['visibility']  = 'private';
  1717 		$data['post_status'] = 'private';
  1928 		$data['post_status'] = 'private';
  1718 	} else {
  1929 	} else {
  1719 		$data['post_status'] = $data['_status'];
  1930 		$data['post_status'] = $data['_status'];
  1720 	}
  1931 	}
  1721 
  1932 
  1722 	if ( empty($data['comment_status']) )
  1933 	if ( empty( $data['comment_status'] ) ) {
  1723 		$data['comment_status'] = 'closed';
  1934 		$data['comment_status'] = 'closed';
  1724 	if ( empty($data['ping_status']) )
  1935 	}
       
  1936 	if ( empty( $data['ping_status'] ) ) {
  1725 		$data['ping_status'] = 'closed';
  1937 		$data['ping_status'] = 'closed';
       
  1938 	}
  1726 
  1939 
  1727 	// Exclude terms from taxonomies that are not supposed to appear in Quick Edit.
  1940 	// Exclude terms from taxonomies that are not supposed to appear in Quick Edit.
  1728 	if ( ! empty( $data['tax_input'] ) ) {
  1941 	if ( ! empty( $data['tax_input'] ) ) {
  1729 		foreach ( $data['tax_input'] as $taxonomy => $terms ) {
  1942 		foreach ( $data['tax_input'] as $taxonomy => $terms ) {
  1730 			$tax_object = get_taxonomy( $taxonomy );
  1943 			$tax_object = get_taxonomy( $taxonomy );
  1736 	}
  1949 	}
  1737 
  1950 
  1738 	// Hack: wp_unique_post_slug() doesn't work for drafts, so we will fake that our post is published.
  1951 	// Hack: wp_unique_post_slug() doesn't work for drafts, so we will fake that our post is published.
  1739 	if ( ! empty( $data['post_name'] ) && in_array( $post['post_status'], array( 'draft', 'pending' ) ) ) {
  1952 	if ( ! empty( $data['post_name'] ) && in_array( $post['post_status'], array( 'draft', 'pending' ) ) ) {
  1740 		$post['post_status'] = 'publish';
  1953 		$post['post_status'] = 'publish';
  1741 		$data['post_name'] = wp_unique_post_slug( $data['post_name'], $post['ID'], $post['post_status'], $post['post_type'], $post['post_parent'] );
  1954 		$data['post_name']   = wp_unique_post_slug( $data['post_name'], $post['ID'], $post['post_status'], $post['post_type'], $post['post_parent'] );
  1742 	}
  1955 	}
  1743 
  1956 
  1744 	// Update the post.
  1957 	// Update the post.
  1745 	edit_post();
  1958 	edit_post();
  1746 
  1959 
  1772  */
  1985  */
  1773 function wp_ajax_inline_save_tax() {
  1986 function wp_ajax_inline_save_tax() {
  1774 	check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
  1987 	check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
  1775 
  1988 
  1776 	$taxonomy = sanitize_key( $_POST['taxonomy'] );
  1989 	$taxonomy = sanitize_key( $_POST['taxonomy'] );
  1777 	$tax = get_taxonomy( $taxonomy );
  1990 	$tax      = get_taxonomy( $taxonomy );
  1778 	if ( ! $tax )
  1991 	if ( ! $tax ) {
  1779 		wp_die( 0 );
  1992 		wp_die( 0 );
       
  1993 	}
  1780 
  1994 
  1781 	if ( ! isset( $_POST['tax_ID'] ) || ! ( $id = (int) $_POST['tax_ID'] ) ) {
  1995 	if ( ! isset( $_POST['tax_ID'] ) || ! ( $id = (int) $_POST['tax_ID'] ) ) {
  1782 		wp_die( -1 );
  1996 		wp_die( -1 );
  1783 	}
  1997 	}
  1784 
  1998 
  1786 		wp_die( -1 );
  2000 		wp_die( -1 );
  1787 	}
  2001 	}
  1788 
  2002 
  1789 	$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
  2003 	$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
  1790 
  2004 
  1791 	$tag = get_term( $id, $taxonomy );
  2005 	$tag                  = get_term( $id, $taxonomy );
  1792 	$_POST['description'] = $tag->description;
  2006 	$_POST['description'] = $tag->description;
  1793 
  2007 
  1794 	$updated = wp_update_term($id, $taxonomy, $_POST);
  2008 	$updated = wp_update_term( $id, $taxonomy, $_POST );
  1795 	if ( $updated && !is_wp_error($updated) ) {
  2009 	if ( $updated && ! is_wp_error( $updated ) ) {
  1796 		$tag = get_term( $updated['term_id'], $taxonomy );
  2010 		$tag = get_term( $updated['term_id'], $taxonomy );
  1797 		if ( !$tag || is_wp_error( $tag ) ) {
  2011 		if ( ! $tag || is_wp_error( $tag ) ) {
  1798 			if ( is_wp_error($tag) && $tag->get_error_message() )
  2012 			if ( is_wp_error( $tag ) && $tag->get_error_message() ) {
  1799 				wp_die( $tag->get_error_message() );
  2013 				wp_die( $tag->get_error_message() );
       
  2014 			}
  1800 			wp_die( __( 'Item not updated.' ) );
  2015 			wp_die( __( 'Item not updated.' ) );
  1801 		}
  2016 		}
  1802 	} else {
  2017 	} else {
  1803 		if ( is_wp_error($updated) && $updated->get_error_message() )
  2018 		if ( is_wp_error( $updated ) && $updated->get_error_message() ) {
  1804 			wp_die( $updated->get_error_message() );
  2019 			wp_die( $updated->get_error_message() );
       
  2020 		}
  1805 		wp_die( __( 'Item not updated.' ) );
  2021 		wp_die( __( 'Item not updated.' ) );
  1806 	}
  2022 	}
  1807 	$level = 0;
  2023 	$level  = 0;
  1808 	$parent = $tag->parent;
  2024 	$parent = $tag->parent;
  1809 	while ( $parent > 0 ) {
  2025 	while ( $parent > 0 ) {
  1810 		$parent_tag = get_term( $parent, $taxonomy );
  2026 		$parent_tag = get_term( $parent, $taxonomy );
  1811 		$parent = $parent_tag->parent;
  2027 		$parent     = $parent_tag->parent;
  1812 		$level++;
  2028 		$level++;
  1813 	}
  2029 	}
  1814 	$wp_list_table->single_row( $tag, $level );
  2030 	$wp_list_table->single_row( $tag, $level );
  1815 	wp_die();
  2031 	wp_die();
  1816 }
  2032 }
  1826 	check_ajax_referer( 'find-posts' );
  2042 	check_ajax_referer( 'find-posts' );
  1827 
  2043 
  1828 	$post_types = get_post_types( array( 'public' => true ), 'objects' );
  2044 	$post_types = get_post_types( array( 'public' => true ), 'objects' );
  1829 	unset( $post_types['attachment'] );
  2045 	unset( $post_types['attachment'] );
  1830 
  2046 
  1831 	$s = wp_unslash( $_POST['ps'] );
  2047 	$s    = wp_unslash( $_POST['ps'] );
  1832 	$args = array(
  2048 	$args = array(
  1833 		'post_type' => array_keys( $post_types ),
  2049 		'post_type'      => array_keys( $post_types ),
  1834 		'post_status' => 'any',
  2050 		'post_status'    => 'any',
  1835 		'posts_per_page' => 50,
  2051 		'posts_per_page' => 50,
  1836 	);
  2052 	);
  1837 	if ( '' !== $s )
  2053 	if ( '' !== $s ) {
  1838 		$args['s'] = $s;
  2054 		$args['s'] = $s;
       
  2055 	}
  1839 
  2056 
  1840 	$posts = get_posts( $args );
  2057 	$posts = get_posts( $args );
  1841 
  2058 
  1842 	if ( ! $posts ) {
  2059 	if ( ! $posts ) {
  1843 		wp_send_json_error( __( 'No items found.' ) );
  2060 		wp_send_json_error( __( 'No items found.' ) );
  1844 	}
  2061 	}
  1845 
  2062 
  1846 	$html = '<table class="widefat"><thead><tr><th class="found-radio"><br /></th><th>'.__('Title').'</th><th class="no-break">'.__('Type').'</th><th class="no-break">'.__('Date').'</th><th class="no-break">'.__('Status').'</th></tr></thead><tbody>';
  2063 	$html = '<table class="widefat"><thead><tr><th class="found-radio"><br /></th><th>' . __( 'Title' ) . '</th><th class="no-break">' . __( 'Type' ) . '</th><th class="no-break">' . __( 'Date' ) . '</th><th class="no-break">' . __( 'Status' ) . '</th></tr></thead><tbody>';
  1847 	$alt = '';
  2064 	$alt  = '';
  1848 	foreach ( $posts as $post ) {
  2065 	foreach ( $posts as $post ) {
  1849 		$title = trim( $post->post_title ) ? $post->post_title : __( '(no title)' );
  2066 		$title = trim( $post->post_title ) ? $post->post_title : __( '(no title)' );
  1850 		$alt = ( 'alternate' == $alt ) ? '' : 'alternate';
  2067 		$alt   = ( 'alternate' == $alt ) ? '' : 'alternate';
  1851 
  2068 
  1852 		switch ( $post->post_status ) {
  2069 		switch ( $post->post_status ) {
  1853 			case 'publish' :
  2070 			case 'publish':
  1854 			case 'private' :
  2071 			case 'private':
  1855 				$stat = __('Published');
  2072 				$stat = __( 'Published' );
  1856 				break;
  2073 				break;
  1857 			case 'future' :
  2074 			case 'future':
  1858 				$stat = __('Scheduled');
  2075 				$stat = __( 'Scheduled' );
  1859 				break;
  2076 				break;
  1860 			case 'pending' :
  2077 			case 'pending':
  1861 				$stat = __('Pending Review');
  2078 				$stat = __( 'Pending Review' );
  1862 				break;
  2079 				break;
  1863 			case 'draft' :
  2080 			case 'draft':
  1864 				$stat = __('Draft');
  2081 				$stat = __( 'Draft' );
  1865 				break;
  2082 				break;
  1866 		}
  2083 		}
  1867 
  2084 
  1868 		if ( '0000-00-00 00:00:00' == $post->post_date ) {
  2085 		if ( '0000-00-00 00:00:00' == $post->post_date ) {
  1869 			$time = '';
  2086 			$time = '';
  1870 		} else {
  2087 		} else {
  1871 			/* translators: date format in table columns, see https://secure.php.net/date */
  2088 			/* translators: date format in table columns, see https://secure.php.net/date */
  1872 			$time = mysql2date(__('Y/m/d'), $post->post_date);
  2089 			$time = mysql2date( __( 'Y/m/d' ), $post->post_date );
  1873 		}
  2090 		}
  1874 
  2091 
  1875 		$html .= '<tr class="' . trim( 'found-posts ' . $alt ) . '"><td class="found-radio"><input type="radio" id="found-'.$post->ID.'" name="found_post_id" value="' . esc_attr($post->ID) . '"></td>';
  2092 		$html .= '<tr class="' . trim( 'found-posts ' . $alt ) . '"><td class="found-radio"><input type="radio" id="found-' . $post->ID . '" name="found_post_id" value="' . esc_attr( $post->ID ) . '"></td>';
  1876 		$html .= '<td><label for="found-'.$post->ID.'">' . esc_html( $title ) . '</label></td><td class="no-break">' . esc_html( $post_types[$post->post_type]->labels->singular_name ) . '</td><td class="no-break">'.esc_html( $time ) . '</td><td class="no-break">' . esc_html( $stat ). ' </td></tr>' . "\n\n";
  2093 		$html .= '<td><label for="found-' . $post->ID . '">' . esc_html( $title ) . '</label></td><td class="no-break">' . esc_html( $post_types[ $post->post_type ]->labels->singular_name ) . '</td><td class="no-break">' . esc_html( $time ) . '</td><td class="no-break">' . esc_html( $stat ) . ' </td></tr>' . "\n\n";
  1877 	}
  2094 	}
  1878 
  2095 
  1879 	$html .= '</tbody></table>';
  2096 	$html .= '</tbody></table>';
  1880 
  2097 
  1881 	wp_send_json_success( $html );
  2098 	wp_send_json_success( $html );
  1887  * @since 3.1.0
  2104  * @since 3.1.0
  1888  */
  2105  */
  1889 function wp_ajax_widgets_order() {
  2106 function wp_ajax_widgets_order() {
  1890 	check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
  2107 	check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
  1891 
  2108 
  1892 	if ( !current_user_can('edit_theme_options') )
  2109 	if ( ! current_user_can( 'edit_theme_options' ) ) {
  1893 		wp_die( -1 );
  2110 		wp_die( -1 );
       
  2111 	}
  1894 
  2112 
  1895 	unset( $_POST['savewidgets'], $_POST['action'] );
  2113 	unset( $_POST['savewidgets'], $_POST['action'] );
  1896 
  2114 
  1897 	// Save widgets order for all sidebars.
  2115 	// Save widgets order for all sidebars.
  1898 	if ( is_array($_POST['sidebars']) ) {
  2116 	if ( is_array( $_POST['sidebars'] ) ) {
  1899 		$sidebars = array();
  2117 		$sidebars = array();
  1900 		foreach ( wp_unslash( $_POST['sidebars'] ) as $key => $val ) {
  2118 		foreach ( wp_unslash( $_POST['sidebars'] ) as $key => $val ) {
  1901 			$sb = array();
  2119 			$sb = array();
  1902 			if ( !empty($val) ) {
  2120 			if ( ! empty( $val ) ) {
  1903 				$val = explode(',', $val);
  2121 				$val = explode( ',', $val );
  1904 				foreach ( $val as $k => $v ) {
  2122 				foreach ( $val as $k => $v ) {
  1905 					if ( strpos($v, 'widget-') === false )
  2123 					if ( strpos( $v, 'widget-' ) === false ) {
  1906 						continue;
  2124 						continue;
  1907 
  2125 					}
  1908 					$sb[$k] = substr($v, strpos($v, '_') + 1);
  2126 
       
  2127 					$sb[ $k ] = substr( $v, strpos( $v, '_' ) + 1 );
  1909 				}
  2128 				}
  1910 			}
  2129 			}
  1911 			$sidebars[$key] = $sb;
  2130 			$sidebars[ $key ] = $sb;
  1912 		}
  2131 		}
  1913 		wp_set_sidebars_widgets($sidebars);
  2132 		wp_set_sidebars_widgets( $sidebars );
  1914 		wp_die( 1 );
  2133 		wp_die( 1 );
  1915 	}
  2134 	}
  1916 
  2135 
  1917 	wp_die( -1 );
  2136 	wp_die( -1 );
  1918 }
  2137 }
  1929 function wp_ajax_save_widget() {
  2148 function wp_ajax_save_widget() {
  1930 	global $wp_registered_widgets, $wp_registered_widget_controls, $wp_registered_widget_updates;
  2149 	global $wp_registered_widgets, $wp_registered_widget_controls, $wp_registered_widget_updates;
  1931 
  2150 
  1932 	check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
  2151 	check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
  1933 
  2152 
  1934 	if ( !current_user_can('edit_theme_options') || !isset($_POST['id_base']) )
  2153 	if ( ! current_user_can( 'edit_theme_options' ) || ! isset( $_POST['id_base'] ) ) {
  1935 		wp_die( -1 );
  2154 		wp_die( -1 );
       
  2155 	}
  1936 
  2156 
  1937 	unset( $_POST['savewidgets'], $_POST['action'] );
  2157 	unset( $_POST['savewidgets'], $_POST['action'] );
  1938 
  2158 
  1939 	/**
  2159 	/**
  1940 	 * Fires early when editing the widgets displayed in sidebars.
  2160 	 * Fires early when editing the widgets displayed in sidebars.
  1951 	do_action( 'widgets.php' );
  2171 	do_action( 'widgets.php' );
  1952 
  2172 
  1953 	/** This action is documented in wp-admin/widgets.php */
  2173 	/** This action is documented in wp-admin/widgets.php */
  1954 	do_action( 'sidebar_admin_setup' );
  2174 	do_action( 'sidebar_admin_setup' );
  1955 
  2175 
  1956 	$id_base = wp_unslash( $_POST['id_base'] );
  2176 	$id_base      = wp_unslash( $_POST['id_base'] );
  1957 	$widget_id = wp_unslash( $_POST['widget-id'] );
  2177 	$widget_id    = wp_unslash( $_POST['widget-id'] );
  1958 	$sidebar_id = $_POST['sidebar'];
  2178 	$sidebar_id   = $_POST['sidebar'];
  1959 	$multi_number = !empty($_POST['multi_number']) ? (int) $_POST['multi_number'] : 0;
  2179 	$multi_number = ! empty( $_POST['multi_number'] ) ? (int) $_POST['multi_number'] : 0;
  1960 	$settings = isset($_POST['widget-' . $id_base]) && is_array($_POST['widget-' . $id_base]) ? $_POST['widget-' . $id_base] : false;
  2180 	$settings     = isset( $_POST[ 'widget-' . $id_base ] ) && is_array( $_POST[ 'widget-' . $id_base ] ) ? $_POST[ 'widget-' . $id_base ] : false;
  1961 	$error = '<p>' . __('An error has occurred. Please reload the page and try again.') . '</p>';
  2181 	$error        = '<p>' . __( 'An error has occurred. Please reload the page and try again.' ) . '</p>';
  1962 
  2182 
  1963 	$sidebars = wp_get_sidebars_widgets();
  2183 	$sidebars = wp_get_sidebars_widgets();
  1964 	$sidebar = isset($sidebars[$sidebar_id]) ? $sidebars[$sidebar_id] : array();
  2184 	$sidebar  = isset( $sidebars[ $sidebar_id ] ) ? $sidebars[ $sidebar_id ] : array();
  1965 
  2185 
  1966 	// Delete.
  2186 	// Delete.
  1967 	if ( isset($_POST['delete_widget']) && $_POST['delete_widget'] ) {
  2187 	if ( isset( $_POST['delete_widget'] ) && $_POST['delete_widget'] ) {
  1968 
  2188 
  1969 		if ( !isset($wp_registered_widgets[$widget_id]) )
  2189 		if ( ! isset( $wp_registered_widgets[ $widget_id ] ) ) {
  1970 			wp_die( $error );
  2190 			wp_die( $error );
  1971 
  2191 		}
  1972 		$sidebar = array_diff( $sidebar, array($widget_id) );
  2192 
  1973 		$_POST = array('sidebar' => $sidebar_id, 'widget-' . $id_base => array(), 'the-widget-id' => $widget_id, 'delete_widget' => '1');
  2193 		$sidebar = array_diff( $sidebar, array( $widget_id ) );
       
  2194 		$_POST   = array(
       
  2195 			'sidebar'            => $sidebar_id,
       
  2196 			'widget-' . $id_base => array(),
       
  2197 			'the-widget-id'      => $widget_id,
       
  2198 			'delete_widget'      => '1',
       
  2199 		);
  1974 
  2200 
  1975 		/** This action is documented in wp-admin/widgets.php */
  2201 		/** This action is documented in wp-admin/widgets.php */
  1976 		do_action( 'delete_widget', $widget_id, $sidebar_id, $id_base );
  2202 		do_action( 'delete_widget', $widget_id, $sidebar_id, $id_base );
  1977 
  2203 
  1978 	} elseif ( $settings && preg_match( '/__i__|%i%/', key($settings) ) ) {
  2204 	} elseif ( $settings && preg_match( '/__i__|%i%/', key( $settings ) ) ) {
  1979 		if ( !$multi_number )
  2205 		if ( ! $multi_number ) {
  1980 			wp_die( $error );
  2206 			wp_die( $error );
       
  2207 		}
  1981 
  2208 
  1982 		$_POST[ 'widget-' . $id_base ] = array( $multi_number => reset( $settings ) );
  2209 		$_POST[ 'widget-' . $id_base ] = array( $multi_number => reset( $settings ) );
  1983 		$widget_id = $id_base . '-' . $multi_number;
  2210 		$widget_id                     = $id_base . '-' . $multi_number;
  1984 		$sidebar[] = $widget_id;
  2211 		$sidebar[]                     = $widget_id;
  1985 	}
  2212 	}
  1986 	$_POST['widget-id'] = $sidebar;
  2213 	$_POST['widget-id'] = $sidebar;
  1987 
  2214 
  1988 	foreach ( (array) $wp_registered_widget_updates as $name => $control ) {
  2215 	foreach ( (array) $wp_registered_widget_updates as $name => $control ) {
  1989 
  2216 
  1990 		if ( $name == $id_base ) {
  2217 		if ( $name == $id_base ) {
  1991 			if ( !is_callable( $control['callback'] ) )
  2218 			if ( ! is_callable( $control['callback'] ) ) {
  1992 				continue;
  2219 				continue;
       
  2220 			}
  1993 
  2221 
  1994 			ob_start();
  2222 			ob_start();
  1995 				call_user_func_array( $control['callback'], $control['params'] );
  2223 				call_user_func_array( $control['callback'], $control['params'] );
  1996 			ob_end_clean();
  2224 			ob_end_clean();
  1997 			break;
  2225 			break;
  1998 		}
  2226 		}
  1999 	}
  2227 	}
  2000 
  2228 
  2001 	if ( isset($_POST['delete_widget']) && $_POST['delete_widget'] ) {
  2229 	if ( isset( $_POST['delete_widget'] ) && $_POST['delete_widget'] ) {
  2002 		$sidebars[$sidebar_id] = $sidebar;
  2230 		$sidebars[ $sidebar_id ] = $sidebar;
  2003 		wp_set_sidebars_widgets($sidebars);
  2231 		wp_set_sidebars_widgets( $sidebars );
  2004 		echo "deleted:$widget_id";
  2232 		echo "deleted:$widget_id";
  2005 		wp_die();
  2233 		wp_die();
  2006 	}
  2234 	}
  2007 
  2235 
  2008 	if ( !empty($_POST['add_new']) )
  2236 	if ( ! empty( $_POST['add_new'] ) ) {
  2009 		wp_die();
  2237 		wp_die();
  2010 
  2238 	}
  2011 	if ( $form = $wp_registered_widget_controls[$widget_id] )
  2239 
       
  2240 	if ( $form = $wp_registered_widget_controls[ $widget_id ] ) {
  2012 		call_user_func_array( $form['callback'], $form['params'] );
  2241 		call_user_func_array( $form['callback'], $form['params'] );
       
  2242 	}
  2013 
  2243 
  2014 	wp_die();
  2244 	wp_die();
  2015 }
  2245 }
  2016 
  2246 
  2017 /**
  2247 /**
  2047 	do_action( 'sidebar_admin_setup' );
  2277 	do_action( 'sidebar_admin_setup' );
  2048 
  2278 
  2049 	$sidebars_widgets = wp_get_sidebars_widgets();
  2279 	$sidebars_widgets = wp_get_sidebars_widgets();
  2050 
  2280 
  2051 	foreach ( $sidebars_widgets['wp_inactive_widgets'] as $key => $widget_id ) {
  2281 	foreach ( $sidebars_widgets['wp_inactive_widgets'] as $key => $widget_id ) {
  2052 		$pieces = explode( '-', $widget_id );
  2282 		$pieces       = explode( '-', $widget_id );
  2053 		$multi_number = array_pop( $pieces );
  2283 		$multi_number = array_pop( $pieces );
  2054 		$id_base = implode( '-', $pieces );
  2284 		$id_base      = implode( '-', $pieces );
  2055 		$widget = get_option( 'widget_' . $id_base );
  2285 		$widget       = get_option( 'widget_' . $id_base );
  2056 		unset( $widget[$multi_number] );
  2286 		unset( $widget[ $multi_number ] );
  2057 		update_option( 'widget_' . $id_base, $widget );
  2287 		update_option( 'widget_' . $id_base, $widget );
  2058 		unset( $sidebars_widgets['wp_inactive_widgets'][$key] );
  2288 		unset( $sidebars_widgets['wp_inactive_widgets'][ $key ] );
  2059 	}
  2289 	}
  2060 
  2290 
  2061 	wp_set_sidebars_widgets( $sidebars_widgets );
  2291 	wp_set_sidebars_widgets( $sidebars_widgets );
  2062 
  2292 
  2063 	wp_die();
  2293 	wp_die();
  2075 	 * as the html4 Plupload handler requires a text/html content-type for older IE.
  2305 	 * as the html4 Plupload handler requires a text/html content-type for older IE.
  2076 	 * See https://core.trac.wordpress.org/ticket/31037
  2306 	 * See https://core.trac.wordpress.org/ticket/31037
  2077 	 */
  2307 	 */
  2078 
  2308 
  2079 	if ( ! current_user_can( 'upload_files' ) ) {
  2309 	if ( ! current_user_can( 'upload_files' ) ) {
  2080 		echo wp_json_encode( array(
  2310 		echo wp_json_encode(
  2081 			'success' => false,
  2311 			array(
  2082 			'data'    => array(
  2312 				'success' => false,
  2083 				'message'  => __( 'Sorry, you are not allowed to upload files.' ),
  2313 				'data'    => array(
  2084 				'filename' => $_FILES['async-upload']['name'],
  2314 					'message'  => __( 'Sorry, you are not allowed to upload files.' ),
       
  2315 					'filename' => esc_html( $_FILES['async-upload']['name'] ),
       
  2316 				),
  2085 			)
  2317 			)
  2086 		) );
  2318 		);
  2087 
  2319 
  2088 		wp_die();
  2320 		wp_die();
  2089 	}
  2321 	}
  2090 
  2322 
  2091 	if ( isset( $_REQUEST['post_id'] ) ) {
  2323 	if ( isset( $_REQUEST['post_id'] ) ) {
  2092 		$post_id = $_REQUEST['post_id'];
  2324 		$post_id = $_REQUEST['post_id'];
  2093 		if ( ! current_user_can( 'edit_post', $post_id ) ) {
  2325 		if ( ! current_user_can( 'edit_post', $post_id ) ) {
  2094 			echo wp_json_encode( array(
  2326 			echo wp_json_encode(
  2095 				'success' => false,
  2327 				array(
  2096 				'data'    => array(
  2328 					'success' => false,
  2097 					'message'  => __( 'Sorry, you are not allowed to attach files to this post.' ),
  2329 					'data'    => array(
  2098 					'filename' => $_FILES['async-upload']['name'],
  2330 						'message'  => __( 'Sorry, you are not allowed to attach files to this post.' ),
       
  2331 						'filename' => esc_html( $_FILES['async-upload']['name'] ),
       
  2332 					),
  2099 				)
  2333 				)
  2100 			) );
  2334 			);
  2101 
  2335 
  2102 			wp_die();
  2336 			wp_die();
  2103 		}
  2337 		}
  2104 	} else {
  2338 	} else {
  2105 		$post_id = null;
  2339 		$post_id = null;
  2106 	}
  2340 	}
  2107 
  2341 
  2108 	$post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
  2342 	$post_data = ! empty( $_REQUEST['post_data'] ) ? _wp_get_allowed_postdata( _wp_translate_postdata( false, (array) $_REQUEST['post_data'] ) ) : array();
       
  2343 
       
  2344 	if ( is_wp_error( $post_data ) ) {
       
  2345 		wp_die( $post_data->get_error_message() );
       
  2346 	}
  2109 
  2347 
  2110 	// If the context is custom header or background, make sure the uploaded file is an image.
  2348 	// If the context is custom header or background, make sure the uploaded file is an image.
  2111 	if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
  2349 	if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
  2112 		$wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'] );
  2350 		$wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'] );
  2113 		if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
  2351 		if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
  2114 			echo wp_json_encode( array(
  2352 			echo wp_json_encode(
       
  2353 				array(
       
  2354 					'success' => false,
       
  2355 					'data'    => array(
       
  2356 						'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
       
  2357 						'filename' => esc_html( $_FILES['async-upload']['name'] ),
       
  2358 					),
       
  2359 				)
       
  2360 			);
       
  2361 
       
  2362 			wp_die();
       
  2363 		}
       
  2364 	}
       
  2365 
       
  2366 	$attachment_id = media_handle_upload( 'async-upload', $post_id, $post_data );
       
  2367 
       
  2368 	if ( is_wp_error( $attachment_id ) ) {
       
  2369 		echo wp_json_encode(
       
  2370 			array(
  2115 				'success' => false,
  2371 				'success' => false,
  2116 				'data'    => array(
  2372 				'data'    => array(
  2117 					'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
  2373 					'message'  => $attachment_id->get_error_message(),
  2118 					'filename' => $_FILES['async-upload']['name'],
  2374 					'filename' => esc_html( $_FILES['async-upload']['name'] ),
  2119 				)
  2375 				),
  2120 			) );
       
  2121 
       
  2122 			wp_die();
       
  2123 		}
       
  2124 	}
       
  2125 
       
  2126 	$attachment_id = media_handle_upload( 'async-upload', $post_id, $post_data );
       
  2127 
       
  2128 	if ( is_wp_error( $attachment_id ) ) {
       
  2129 		echo wp_json_encode( array(
       
  2130 			'success' => false,
       
  2131 			'data'    => array(
       
  2132 				'message'  => $attachment_id->get_error_message(),
       
  2133 				'filename' => $_FILES['async-upload']['name'],
       
  2134 			)
  2376 			)
  2135 		) );
  2377 		);
  2136 
  2378 
  2137 		wp_die();
  2379 		wp_die();
  2138 	}
  2380 	}
  2139 
  2381 
  2140 	if ( isset( $post_data['context'] ) && isset( $post_data['theme'] ) ) {
  2382 	if ( isset( $post_data['context'] ) && isset( $post_data['theme'] ) ) {
  2141 		if ( 'custom-background' === $post_data['context'] )
  2383 		if ( 'custom-background' === $post_data['context'] ) {
  2142 			update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
  2384 			update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
  2143 
  2385 		}
  2144 		if ( 'custom-header' === $post_data['context'] )
  2386 
       
  2387 		if ( 'custom-header' === $post_data['context'] ) {
  2145 			update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
  2388 			update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
  2146 	}
  2389 		}
  2147 
  2390 	}
  2148 	if ( ! $attachment = wp_prepare_attachment_for_js( $attachment_id ) )
  2391 
       
  2392 	if ( ! $attachment = wp_prepare_attachment_for_js( $attachment_id ) ) {
  2149 		wp_die();
  2393 		wp_die();
  2150 
  2394 	}
  2151 	echo wp_json_encode( array(
  2395 
  2152 		'success' => true,
  2396 	echo wp_json_encode(
  2153 		'data'    => $attachment,
  2397 		array(
  2154 	) );
  2398 			'success' => true,
       
  2399 			'data'    => $attachment,
       
  2400 		)
       
  2401 	);
  2155 
  2402 
  2156 	wp_die();
  2403 	wp_die();
  2157 }
  2404 }
  2158 
  2405 
  2159 /**
  2406 /**
  2160  * Ajax handler for image editing.
  2407  * Ajax handler for image editing.
  2161  *
  2408  *
  2162  * @since 3.1.0
  2409  * @since 3.1.0
  2163  */
  2410  */
  2164 function wp_ajax_image_editor() {
  2411 function wp_ajax_image_editor() {
  2165 	$attachment_id = intval($_POST['postid']);
  2412 	$attachment_id = intval( $_POST['postid'] );
  2166 	if ( empty($attachment_id) || !current_user_can('edit_post', $attachment_id) )
  2413 	if ( empty( $attachment_id ) || ! current_user_can( 'edit_post', $attachment_id ) ) {
  2167 		wp_die( -1 );
  2414 		wp_die( -1 );
       
  2415 	}
  2168 
  2416 
  2169 	check_ajax_referer( "image_editor-$attachment_id" );
  2417 	check_ajax_referer( "image_editor-$attachment_id" );
  2170 	include_once( ABSPATH . 'wp-admin/includes/image-edit.php' );
  2418 	include_once( ABSPATH . 'wp-admin/includes/image-edit.php' );
  2171 
  2419 
  2172 	$msg = false;
  2420 	$msg = false;
  2173 	switch ( $_POST['do'] ) {
  2421 	switch ( $_POST['do'] ) {
  2174 		case 'save' :
  2422 		case 'save':
  2175 			$msg = wp_save_image($attachment_id);
  2423 			$msg = wp_save_image( $attachment_id );
  2176 			$msg = wp_json_encode($msg);
  2424 			$msg = wp_json_encode( $msg );
  2177 			wp_die( $msg );
  2425 			wp_die( $msg );
  2178 			break;
  2426 			break;
  2179 		case 'scale' :
  2427 		case 'scale':
  2180 			$msg = wp_save_image($attachment_id);
  2428 			$msg = wp_save_image( $attachment_id );
  2181 			break;
  2429 			break;
  2182 		case 'restore' :
  2430 		case 'restore':
  2183 			$msg = wp_restore_image($attachment_id);
  2431 			$msg = wp_restore_image( $attachment_id );
  2184 			break;
  2432 			break;
  2185 	}
  2433 	}
  2186 
  2434 
  2187 	wp_image_editor($attachment_id, $msg);
  2435 	wp_image_editor( $attachment_id, $msg );
  2188 	wp_die();
  2436 	wp_die();
  2189 }
  2437 }
  2190 
  2438 
  2191 /**
  2439 /**
  2192  * Ajax handler for setting the featured image.
  2440  * Ajax handler for setting the featured image.
  2195  */
  2443  */
  2196 function wp_ajax_set_post_thumbnail() {
  2444 function wp_ajax_set_post_thumbnail() {
  2197 	$json = ! empty( $_REQUEST['json'] ); // New-style request
  2445 	$json = ! empty( $_REQUEST['json'] ); // New-style request
  2198 
  2446 
  2199 	$post_ID = intval( $_POST['post_id'] );
  2447 	$post_ID = intval( $_POST['post_id'] );
  2200 	if ( ! current_user_can( 'edit_post', $post_ID ) )
  2448 	if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  2201 		wp_die( -1 );
  2449 		wp_die( -1 );
       
  2450 	}
  2202 
  2451 
  2203 	$thumbnail_id = intval( $_POST['thumbnail_id'] );
  2452 	$thumbnail_id = intval( $_POST['thumbnail_id'] );
  2204 
  2453 
  2205 	if ( $json )
  2454 	if ( $json ) {
  2206 		check_ajax_referer( "update-post_$post_ID" );
  2455 		check_ajax_referer( "update-post_$post_ID" );
  2207 	else
  2456 	} else {
  2208 		check_ajax_referer( "set_post_thumbnail-$post_ID" );
  2457 		check_ajax_referer( "set_post_thumbnail-$post_ID" );
       
  2458 	}
  2209 
  2459 
  2210 	if ( $thumbnail_id == '-1' ) {
  2460 	if ( $thumbnail_id == '-1' ) {
  2211 		if ( delete_post_thumbnail( $post_ID ) ) {
  2461 		if ( delete_post_thumbnail( $post_ID ) ) {
  2212 			$return = _wp_post_thumbnail_html( null, $post_ID );
  2462 			$return = _wp_post_thumbnail_html( null, $post_ID );
  2213 			$json ? wp_send_json_success( $return ) : wp_die( $return );
  2463 			$json ? wp_send_json_success( $return ) : wp_die( $return );
  2327 function wp_ajax_wp_fullscreen_save_post() {
  2577 function wp_ajax_wp_fullscreen_save_post() {
  2328 	$post_id = isset( $_POST['post_ID'] ) ? (int) $_POST['post_ID'] : 0;
  2578 	$post_id = isset( $_POST['post_ID'] ) ? (int) $_POST['post_ID'] : 0;
  2329 
  2579 
  2330 	$post = null;
  2580 	$post = null;
  2331 
  2581 
  2332 	if ( $post_id )
  2582 	if ( $post_id ) {
  2333 		$post = get_post( $post_id );
  2583 		$post = get_post( $post_id );
  2334 
  2584 	}
  2335 	check_ajax_referer('update-post_' . $post_id, '_wpnonce');
  2585 
       
  2586 	check_ajax_referer( 'update-post_' . $post_id, '_wpnonce' );
  2336 
  2587 
  2337 	$post_id = edit_post();
  2588 	$post_id = edit_post();
  2338 
  2589 
  2339 	if ( is_wp_error( $post_id ) ) {
  2590 	if ( is_wp_error( $post_id ) ) {
  2340 		wp_send_json_error();
  2591 		wp_send_json_error();
  2348 		$last_time = date_i18n( __( 'g:i a' ) );
  2599 		$last_time = date_i18n( __( 'g:i a' ) );
  2349 	}
  2600 	}
  2350 
  2601 
  2351 	if ( $last_id = get_post_meta( $post_id, '_edit_last', true ) ) {
  2602 	if ( $last_id = get_post_meta( $post_id, '_edit_last', true ) ) {
  2352 		$last_user = get_userdata( $last_id );
  2603 		$last_user = get_userdata( $last_id );
  2353 		$last_edited = sprintf( __('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), $last_date, $last_time );
  2604 		/* translators: 1: display_name of last user, 2: date of last edit, 3: time of last edit. */
       
  2605 		$last_edited = sprintf( __( 'Last edited by %1$s on %2$s at %3$s' ), esc_html( $last_user->display_name ), $last_date, $last_time );
  2354 	} else {
  2606 	} else {
  2355 		$last_edited = sprintf( __('Last edited on %1$s at %2$s'), $last_date, $last_time );
  2607 		/* translators: 1: date of last edit, 2: time of last edit. */
       
  2608 		$last_edited = sprintf( __( 'Last edited on %1$s at %2$s' ), $last_date, $last_time );
  2356 	}
  2609 	}
  2357 
  2610 
  2358 	wp_send_json_success( array( 'last_edited' => $last_edited ) );
  2611 	wp_send_json_success( array( 'last_edited' => $last_edited ) );
  2359 }
  2612 }
  2360 
  2613 
  2362  * Ajax handler for removing a post lock.
  2615  * Ajax handler for removing a post lock.
  2363  *
  2616  *
  2364  * @since 3.1.0
  2617  * @since 3.1.0
  2365  */
  2618  */
  2366 function wp_ajax_wp_remove_post_lock() {
  2619 function wp_ajax_wp_remove_post_lock() {
  2367 	if ( empty( $_POST['post_ID'] ) || empty( $_POST['active_post_lock'] ) )
  2620 	if ( empty( $_POST['post_ID'] ) || empty( $_POST['active_post_lock'] ) ) {
  2368 		wp_die( 0 );
  2621 		wp_die( 0 );
       
  2622 	}
  2369 	$post_id = (int) $_POST['post_ID'];
  2623 	$post_id = (int) $_POST['post_ID'];
  2370 	if ( ! $post = get_post( $post_id ) )
  2624 	if ( ! $post = get_post( $post_id ) ) {
  2371 		wp_die( 0 );
  2625 		wp_die( 0 );
       
  2626 	}
  2372 
  2627 
  2373 	check_ajax_referer( 'update-post_' . $post_id );
  2628 	check_ajax_referer( 'update-post_' . $post_id );
  2374 
  2629 
  2375 	if ( ! current_user_can( 'edit_post', $post_id ) )
  2630 	if ( ! current_user_can( 'edit_post', $post_id ) ) {
  2376 		wp_die( -1 );
  2631 		wp_die( -1 );
       
  2632 	}
  2377 
  2633 
  2378 	$active_lock = array_map( 'absint', explode( ':', $_POST['active_post_lock'] ) );
  2634 	$active_lock = array_map( 'absint', explode( ':', $_POST['active_post_lock'] ) );
  2379 	if ( $active_lock[1] != get_current_user_id() )
  2635 	if ( $active_lock[1] != get_current_user_id() ) {
  2380 		wp_die( 0 );
  2636 		wp_die( 0 );
       
  2637 	}
  2381 
  2638 
  2382 	/**
  2639 	/**
  2383 	 * Filters the post lock window duration.
  2640 	 * Filters the post lock window duration.
  2384 	 *
  2641 	 *
  2385 	 * @since 3.3.0
  2642 	 * @since 3.3.0
  2397  *
  2654  *
  2398  * @since 3.1.0
  2655  * @since 3.1.0
  2399  */
  2656  */
  2400 function wp_ajax_dismiss_wp_pointer() {
  2657 function wp_ajax_dismiss_wp_pointer() {
  2401 	$pointer = $_POST['pointer'];
  2658 	$pointer = $_POST['pointer'];
  2402 	if ( $pointer != sanitize_key( $pointer ) )
  2659 	if ( $pointer != sanitize_key( $pointer ) ) {
  2403 		wp_die( 0 );
  2660 		wp_die( 0 );
  2404 
  2661 	}
  2405 //	check_ajax_referer( 'dismiss-pointer_' . $pointer );
  2662 
       
  2663 	//  check_ajax_referer( 'dismiss-pointer_' . $pointer );
  2406 
  2664 
  2407 	$dismissed = array_filter( explode( ',', (string) get_user_meta( get_current_user_id(), 'dismissed_wp_pointers', true ) ) );
  2665 	$dismissed = array_filter( explode( ',', (string) get_user_meta( get_current_user_id(), 'dismissed_wp_pointers', true ) ) );
  2408 
  2666 
  2409 	if ( in_array( $pointer, $dismissed ) )
  2667 	if ( in_array( $pointer, $dismissed ) ) {
  2410 		wp_die( 0 );
  2668 		wp_die( 0 );
       
  2669 	}
  2411 
  2670 
  2412 	$dismissed[] = $pointer;
  2671 	$dismissed[] = $pointer;
  2413 	$dismissed = implode( ',', $dismissed );
  2672 	$dismissed   = implode( ',', $dismissed );
  2414 
  2673 
  2415 	update_user_meta( get_current_user_id(), 'dismissed_wp_pointers', $dismissed );
  2674 	update_user_meta( get_current_user_id(), 'dismissed_wp_pointers', $dismissed );
  2416 	wp_die( 1 );
  2675 	wp_die( 1 );
  2417 }
  2676 }
  2418 
  2677 
  2420  * Ajax handler for getting an attachment.
  2679  * Ajax handler for getting an attachment.
  2421  *
  2680  *
  2422  * @since 3.5.0
  2681  * @since 3.5.0
  2423  */
  2682  */
  2424 function wp_ajax_get_attachment() {
  2683 function wp_ajax_get_attachment() {
  2425 	if ( ! isset( $_REQUEST['id'] ) )
  2684 	if ( ! isset( $_REQUEST['id'] ) ) {
  2426 		wp_send_json_error();
  2685 		wp_send_json_error();
  2427 
  2686 	}
  2428 	if ( ! $id = absint( $_REQUEST['id'] ) )
  2687 
       
  2688 	if ( ! $id = absint( $_REQUEST['id'] ) ) {
  2429 		wp_send_json_error();
  2689 		wp_send_json_error();
  2430 
  2690 	}
  2431 	if ( ! $post = get_post( $id ) )
  2691 
       
  2692 	if ( ! $post = get_post( $id ) ) {
  2432 		wp_send_json_error();
  2693 		wp_send_json_error();
  2433 
  2694 	}
  2434 	if ( 'attachment' != $post->post_type )
  2695 
       
  2696 	if ( 'attachment' != $post->post_type ) {
  2435 		wp_send_json_error();
  2697 		wp_send_json_error();
  2436 
  2698 	}
  2437 	if ( ! current_user_can( 'upload_files' ) )
  2699 
       
  2700 	if ( ! current_user_can( 'upload_files' ) ) {
  2438 		wp_send_json_error();
  2701 		wp_send_json_error();
  2439 
  2702 	}
  2440 	if ( ! $attachment = wp_prepare_attachment_for_js( $id ) )
  2703 
       
  2704 	if ( ! $attachment = wp_prepare_attachment_for_js( $id ) ) {
  2441 		wp_send_json_error();
  2705 		wp_send_json_error();
       
  2706 	}
  2442 
  2707 
  2443 	wp_send_json_success( $attachment );
  2708 	wp_send_json_success( $attachment );
  2444 }
  2709 }
  2445 
  2710 
  2446 /**
  2711 /**
  2447  * Ajax handler for querying attachments.
  2712  * Ajax handler for querying attachments.
  2448  *
  2713  *
  2449  * @since 3.5.0
  2714  * @since 3.5.0
  2450  */
  2715  */
  2451 function wp_ajax_query_attachments() {
  2716 function wp_ajax_query_attachments() {
  2452 	if ( ! current_user_can( 'upload_files' ) )
  2717 	if ( ! current_user_can( 'upload_files' ) ) {
  2453 		wp_send_json_error();
  2718 		wp_send_json_error();
       
  2719 	}
  2454 
  2720 
  2455 	$query = isset( $_REQUEST['query'] ) ? (array) $_REQUEST['query'] : array();
  2721 	$query = isset( $_REQUEST['query'] ) ? (array) $_REQUEST['query'] : array();
  2456 	$keys = array(
  2722 	$keys  = array(
  2457 		's', 'order', 'orderby', 'posts_per_page', 'paged', 'post_mime_type',
  2723 		's',
  2458 		'post_parent', 'author', 'post__in', 'post__not_in', 'year', 'monthnum'
  2724 		'order',
       
  2725 		'orderby',
       
  2726 		'posts_per_page',
       
  2727 		'paged',
       
  2728 		'post_mime_type',
       
  2729 		'post_parent',
       
  2730 		'author',
       
  2731 		'post__in',
       
  2732 		'post__not_in',
       
  2733 		'year',
       
  2734 		'monthnum',
  2459 	);
  2735 	);
  2460 	foreach ( get_taxonomies_for_attachments( 'objects' ) as $t ) {
  2736 	foreach ( get_taxonomies_for_attachments( 'objects' ) as $t ) {
  2461 		if ( $t->query_var && isset( $query[ $t->query_var ] ) ) {
  2737 		if ( $t->query_var && isset( $query[ $t->query_var ] ) ) {
  2462 			$keys[] = $t->query_var;
  2738 			$keys[] = $t->query_var;
  2463 		}
  2739 		}
  2464 	}
  2740 	}
  2465 
  2741 
  2466 	$query = array_intersect_key( $query, array_flip( $keys ) );
  2742 	$query              = array_intersect_key( $query, array_flip( $keys ) );
  2467 	$query['post_type'] = 'attachment';
  2743 	$query['post_type'] = 'attachment';
  2468 	if ( MEDIA_TRASH
  2744 	if ( MEDIA_TRASH
  2469 		&& ! empty( $_REQUEST['query']['post_status'] )
  2745 		&& ! empty( $_REQUEST['query']['post_status'] )
  2470 		&& 'trash' === $_REQUEST['query']['post_status'] ) {
  2746 		&& 'trash' === $_REQUEST['query']['post_status'] ) {
  2471 		$query['post_status'] = 'trash';
  2747 		$query['post_status'] = 'trash';
  2472 	} else {
  2748 	} else {
  2473 		$query['post_status'] = 'inherit';
  2749 		$query['post_status'] = 'inherit';
  2474 	}
  2750 	}
  2475 
  2751 
  2476 	if ( current_user_can( get_post_type_object( 'attachment' )->cap->read_private_posts ) )
  2752 	if ( current_user_can( get_post_type_object( 'attachment' )->cap->read_private_posts ) ) {
  2477 		$query['post_status'] .= ',private';
  2753 		$query['post_status'] .= ',private';
       
  2754 	}
  2478 
  2755 
  2479 	// Filter query clauses to include filenames.
  2756 	// Filter query clauses to include filenames.
  2480 	if ( isset( $query['s'] ) ) {
  2757 	if ( isset( $query['s'] ) ) {
  2481 		add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
  2758 		add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
  2482 	}
  2759 	}
  2504  * Ajax handler for updating attachment attributes.
  2781  * Ajax handler for updating attachment attributes.
  2505  *
  2782  *
  2506  * @since 3.5.0
  2783  * @since 3.5.0
  2507  */
  2784  */
  2508 function wp_ajax_save_attachment() {
  2785 function wp_ajax_save_attachment() {
  2509 	if ( ! isset( $_REQUEST['id'] ) || ! isset( $_REQUEST['changes'] ) )
  2786 	if ( ! isset( $_REQUEST['id'] ) || ! isset( $_REQUEST['changes'] ) ) {
  2510 		wp_send_json_error();
  2787 		wp_send_json_error();
  2511 
  2788 	}
  2512 	if ( ! $id = absint( $_REQUEST['id'] ) )
  2789 
       
  2790 	if ( ! $id = absint( $_REQUEST['id'] ) ) {
  2513 		wp_send_json_error();
  2791 		wp_send_json_error();
       
  2792 	}
  2514 
  2793 
  2515 	check_ajax_referer( 'update-post_' . $id, 'nonce' );
  2794 	check_ajax_referer( 'update-post_' . $id, 'nonce' );
  2516 
  2795 
  2517 	if ( ! current_user_can( 'edit_post', $id ) )
  2796 	if ( ! current_user_can( 'edit_post', $id ) ) {
  2518 		wp_send_json_error();
  2797 		wp_send_json_error();
       
  2798 	}
  2519 
  2799 
  2520 	$changes = $_REQUEST['changes'];
  2800 	$changes = $_REQUEST['changes'];
  2521 	$post    = get_post( $id, ARRAY_A );
  2801 	$post    = get_post( $id, ARRAY_A );
  2522 
  2802 
  2523 	if ( 'attachment' != $post['post_type'] )
  2803 	if ( 'attachment' != $post['post_type'] ) {
  2524 		wp_send_json_error();
  2804 		wp_send_json_error();
  2525 
  2805 	}
  2526 	if ( isset( $changes['parent'] ) )
  2806 
       
  2807 	if ( isset( $changes['parent'] ) ) {
  2527 		$post['post_parent'] = $changes['parent'];
  2808 		$post['post_parent'] = $changes['parent'];
  2528 
  2809 	}
  2529 	if ( isset( $changes['title'] ) )
  2810 
       
  2811 	if ( isset( $changes['title'] ) ) {
  2530 		$post['post_title'] = $changes['title'];
  2812 		$post['post_title'] = $changes['title'];
  2531 
  2813 	}
  2532 	if ( isset( $changes['caption'] ) )
  2814 
       
  2815 	if ( isset( $changes['caption'] ) ) {
  2533 		$post['post_excerpt'] = $changes['caption'];
  2816 		$post['post_excerpt'] = $changes['caption'];
  2534 
  2817 	}
  2535 	if ( isset( $changes['description'] ) )
  2818 
       
  2819 	if ( isset( $changes['description'] ) ) {
  2536 		$post['post_content'] = $changes['description'];
  2820 		$post['post_content'] = $changes['description'];
  2537 
  2821 	}
  2538 	if ( MEDIA_TRASH && isset( $changes['status'] ) )
  2822 
       
  2823 	if ( MEDIA_TRASH && isset( $changes['status'] ) ) {
  2539 		$post['post_status'] = $changes['status'];
  2824 		$post['post_status'] = $changes['status'];
       
  2825 	}
  2540 
  2826 
  2541 	if ( isset( $changes['alt'] ) ) {
  2827 	if ( isset( $changes['alt'] ) ) {
  2542 		$alt = wp_unslash( $changes['alt'] );
  2828 		$alt = wp_unslash( $changes['alt'] );
  2543 		if ( $alt != get_post_meta( $id, '_wp_attachment_image_alt', true ) ) {
  2829 		if ( $alt != get_post_meta( $id, '_wp_attachment_image_alt', true ) ) {
  2544 			$alt = wp_strip_all_tags( $alt, true );
  2830 			$alt = wp_strip_all_tags( $alt, true );
  2553 			$changed = true;
  2839 			$changed = true;
  2554 			$id3data = array();
  2840 			$id3data = array();
  2555 		}
  2841 		}
  2556 		foreach ( wp_get_attachment_id3_keys( (object) $post, 'edit' ) as $key => $label ) {
  2842 		foreach ( wp_get_attachment_id3_keys( (object) $post, 'edit' ) as $key => $label ) {
  2557 			if ( isset( $changes[ $key ] ) ) {
  2843 			if ( isset( $changes[ $key ] ) ) {
  2558 				$changed = true;
  2844 				$changed         = true;
  2559 				$id3data[ $key ] = sanitize_text_field( wp_unslash( $changes[ $key ] ) );
  2845 				$id3data[ $key ] = sanitize_text_field( wp_unslash( $changes[ $key ] ) );
  2560 			}
  2846 			}
  2561 		}
  2847 		}
  2562 
  2848 
  2563 		if ( $changed ) {
  2849 		if ( $changed ) {
  2578  * Ajax handler for saving backward compatible attachment attributes.
  2864  * Ajax handler for saving backward compatible attachment attributes.
  2579  *
  2865  *
  2580  * @since 3.5.0
  2866  * @since 3.5.0
  2581  */
  2867  */
  2582 function wp_ajax_save_attachment_compat() {
  2868 function wp_ajax_save_attachment_compat() {
  2583 	if ( ! isset( $_REQUEST['id'] ) )
  2869 	if ( ! isset( $_REQUEST['id'] ) ) {
  2584 		wp_send_json_error();
  2870 		wp_send_json_error();
  2585 
  2871 	}
  2586 	if ( ! $id = absint( $_REQUEST['id'] ) )
  2872 
       
  2873 	if ( ! $id = absint( $_REQUEST['id'] ) ) {
  2587 		wp_send_json_error();
  2874 		wp_send_json_error();
  2588 
  2875 	}
  2589 	if ( empty( $_REQUEST['attachments'] ) || empty( $_REQUEST['attachments'][ $id ] ) )
  2876 
       
  2877 	if ( empty( $_REQUEST['attachments'] ) || empty( $_REQUEST['attachments'][ $id ] ) ) {
  2590 		wp_send_json_error();
  2878 		wp_send_json_error();
       
  2879 	}
  2591 	$attachment_data = $_REQUEST['attachments'][ $id ];
  2880 	$attachment_data = $_REQUEST['attachments'][ $id ];
  2592 
  2881 
  2593 	check_ajax_referer( 'update-post_' . $id, 'nonce' );
  2882 	check_ajax_referer( 'update-post_' . $id, 'nonce' );
  2594 
  2883 
  2595 	if ( ! current_user_can( 'edit_post', $id ) )
  2884 	if ( ! current_user_can( 'edit_post', $id ) ) {
  2596 		wp_send_json_error();
  2885 		wp_send_json_error();
       
  2886 	}
  2597 
  2887 
  2598 	$post = get_post( $id, ARRAY_A );
  2888 	$post = get_post( $id, ARRAY_A );
  2599 
  2889 
  2600 	if ( 'attachment' != $post['post_type'] )
  2890 	if ( 'attachment' != $post['post_type'] ) {
  2601 		wp_send_json_error();
  2891 		wp_send_json_error();
       
  2892 	}
  2602 
  2893 
  2603 	/** This filter is documented in wp-admin/includes/media.php */
  2894 	/** This filter is documented in wp-admin/includes/media.php */
  2604 	$post = apply_filters( 'attachment_fields_to_save', $post, $attachment_data );
  2895 	$post = apply_filters( 'attachment_fields_to_save', $post, $attachment_data );
  2605 
  2896 
  2606 	if ( isset( $post['errors'] ) ) {
  2897 	if ( isset( $post['errors'] ) ) {
  2609 	}
  2900 	}
  2610 
  2901 
  2611 	wp_update_post( $post );
  2902 	wp_update_post( $post );
  2612 
  2903 
  2613 	foreach ( get_attachment_taxonomies( $post ) as $taxonomy ) {
  2904 	foreach ( get_attachment_taxonomies( $post ) as $taxonomy ) {
  2614 		if ( isset( $attachment_data[ $taxonomy ] ) )
  2905 		if ( isset( $attachment_data[ $taxonomy ] ) ) {
  2615 			wp_set_object_terms( $id, array_map( 'trim', preg_split( '/,+/', $attachment_data[ $taxonomy ] ) ), $taxonomy, false );
  2906 			wp_set_object_terms( $id, array_map( 'trim', preg_split( '/,+/', $attachment_data[ $taxonomy ] ) ), $taxonomy, false );
  2616 	}
  2907 		}
  2617 
  2908 	}
  2618 	if ( ! $attachment = wp_prepare_attachment_for_js( $id ) )
  2909 
       
  2910 	if ( ! $attachment = wp_prepare_attachment_for_js( $id ) ) {
  2619 		wp_send_json_error();
  2911 		wp_send_json_error();
       
  2912 	}
  2620 
  2913 
  2621 	wp_send_json_success( $attachment );
  2914 	wp_send_json_success( $attachment );
  2622 }
  2915 }
  2623 
  2916 
  2624 /**
  2917 /**
  2625  * Ajax handler for saving the attachment order.
  2918  * Ajax handler for saving the attachment order.
  2626  *
  2919  *
  2627  * @since 3.5.0
  2920  * @since 3.5.0
  2628  */
  2921  */
  2629 function wp_ajax_save_attachment_order() {
  2922 function wp_ajax_save_attachment_order() {
  2630 	if ( ! isset( $_REQUEST['post_id'] ) )
  2923 	if ( ! isset( $_REQUEST['post_id'] ) ) {
  2631 		wp_send_json_error();
  2924 		wp_send_json_error();
  2632 
  2925 	}
  2633 	if ( ! $post_id = absint( $_REQUEST['post_id'] ) )
  2926 
       
  2927 	if ( ! $post_id = absint( $_REQUEST['post_id'] ) ) {
  2634 		wp_send_json_error();
  2928 		wp_send_json_error();
  2635 
  2929 	}
  2636 	if ( empty( $_REQUEST['attachments'] ) )
  2930 
       
  2931 	if ( empty( $_REQUEST['attachments'] ) ) {
  2637 		wp_send_json_error();
  2932 		wp_send_json_error();
       
  2933 	}
  2638 
  2934 
  2639 	check_ajax_referer( 'update-post_' . $post_id, 'nonce' );
  2935 	check_ajax_referer( 'update-post_' . $post_id, 'nonce' );
  2640 
  2936 
  2641 	$attachments = $_REQUEST['attachments'];
  2937 	$attachments = $_REQUEST['attachments'];
  2642 
  2938 
  2643 	if ( ! current_user_can( 'edit_post', $post_id ) )
  2939 	if ( ! current_user_can( 'edit_post', $post_id ) ) {
  2644 		wp_send_json_error();
  2940 		wp_send_json_error();
       
  2941 	}
  2645 
  2942 
  2646 	foreach ( $attachments as $attachment_id => $menu_order ) {
  2943 	foreach ( $attachments as $attachment_id => $menu_order ) {
  2647 		if ( ! current_user_can( 'edit_post', $attachment_id ) )
  2944 		if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
  2648 			continue;
  2945 			continue;
  2649 		if ( ! $attachment = get_post( $attachment_id ) )
  2946 		}
       
  2947 		if ( ! $attachment = get_post( $attachment_id ) ) {
  2650 			continue;
  2948 			continue;
  2651 		if ( 'attachment' != $attachment->post_type )
  2949 		}
       
  2950 		if ( 'attachment' != $attachment->post_type ) {
  2652 			continue;
  2951 			continue;
  2653 
  2952 		}
  2654 		wp_update_post( array( 'ID' => $attachment_id, 'menu_order' => $menu_order ) );
  2953 
       
  2954 		wp_update_post(
       
  2955 			array(
       
  2956 				'ID'         => $attachment_id,
       
  2957 				'menu_order' => $menu_order,
       
  2958 			)
       
  2959 		);
  2655 	}
  2960 	}
  2656 
  2961 
  2657 	wp_send_json_success();
  2962 	wp_send_json_success();
  2658 }
  2963 }
  2659 
  2964 
  2671 
  2976 
  2672 	$attachment = wp_unslash( $_POST['attachment'] );
  2977 	$attachment = wp_unslash( $_POST['attachment'] );
  2673 
  2978 
  2674 	$id = intval( $attachment['id'] );
  2979 	$id = intval( $attachment['id'] );
  2675 
  2980 
  2676 	if ( ! $post = get_post( $id ) )
  2981 	if ( ! $post = get_post( $id ) ) {
  2677 		wp_send_json_error();
  2982 		wp_send_json_error();
  2678 
  2983 	}
  2679 	if ( 'attachment' != $post->post_type )
  2984 
       
  2985 	if ( 'attachment' != $post->post_type ) {
  2680 		wp_send_json_error();
  2986 		wp_send_json_error();
       
  2987 	}
  2681 
  2988 
  2682 	if ( current_user_can( 'edit_post', $id ) ) {
  2989 	if ( current_user_can( 'edit_post', $id ) ) {
  2683 		// If this attachment is unattached, attach it. Primarily a back compat thing.
  2990 		// If this attachment is unattached, attach it. Primarily a back compat thing.
  2684 		if ( 0 == $post->post_parent && $insert_into_post_id = intval( $_POST['post_id'] ) ) {
  2991 		if ( 0 == $post->post_parent && $insert_into_post_id = intval( $_POST['post_id'] ) ) {
  2685 			wp_update_post( array( 'ID' => $id, 'post_parent' => $insert_into_post_id ) );
  2992 			wp_update_post(
       
  2993 				array(
       
  2994 					'ID'          => $id,
       
  2995 					'post_parent' => $insert_into_post_id,
       
  2996 				)
       
  2997 			);
  2686 		}
  2998 		}
  2687 	}
  2999 	}
  2688 
  3000 
  2689 	$url = empty( $attachment['url'] ) ? '' : $attachment['url'];
  3001 	$url = empty( $attachment['url'] ) ? '' : $attachment['url'];
  2690 	$rel = ( strpos( $url, 'attachment_id') || get_attachment_link( $id ) == $url );
  3002 	$rel = ( strpos( $url, 'attachment_id' ) || get_attachment_link( $id ) == $url );
  2691 
  3003 
  2692 	remove_filter( 'media_send_to_editor', 'image_media_send_to_editor' );
  3004 	remove_filter( 'media_send_to_editor', 'image_media_send_to_editor' );
  2693 
  3005 
  2694 	if ( 'image' === substr( $post->post_mime_type, 0, 5 ) ) {
  3006 	if ( 'image' === substr( $post->post_mime_type, 0, 5 ) ) {
  2695 		$align = isset( $attachment['align'] ) ? $attachment['align'] : 'none';
  3007 		$align = isset( $attachment['align'] ) ? $attachment['align'] : 'none';
  2696 		$size = isset( $attachment['image-size'] ) ? $attachment['image-size'] : 'medium';
  3008 		$size  = isset( $attachment['image-size'] ) ? $attachment['image-size'] : 'medium';
  2697 		$alt = isset( $attachment['image_alt'] ) ? $attachment['image_alt'] : '';
  3009 		$alt   = isset( $attachment['image_alt'] ) ? $attachment['image_alt'] : '';
  2698 
  3010 
  2699 		// No whitespace-only captions.
  3011 		// No whitespace-only captions.
  2700 		$caption = isset( $attachment['post_excerpt'] ) ? $attachment['post_excerpt'] : '';
  3012 		$caption = isset( $attachment['post_excerpt'] ) ? $attachment['post_excerpt'] : '';
  2701 		if ( '' === trim( $caption ) ) {
  3013 		if ( '' === trim( $caption ) ) {
  2702 			$caption = '';
  3014 			$caption = '';
  2703 		}
  3015 		}
  2704 
  3016 
  2705 		$title = ''; // We no longer insert title tags into <img> tags, as they are redundant.
  3017 		$title = ''; // We no longer insert title tags into <img> tags, as they are redundant.
  2706 		$html = get_image_send_to_editor( $id, $caption, $title, $align, $url, $rel, $size, $alt );
  3018 		$html  = get_image_send_to_editor( $id, $caption, $title, $align, $url, $rel, $size, $alt );
  2707 	} elseif ( wp_attachment_is( 'video', $post ) || wp_attachment_is( 'audio', $post )  ) {
  3019 	} elseif ( wp_attachment_is( 'video', $post ) || wp_attachment_is( 'audio', $post ) ) {
  2708 		$html = stripslashes_deep( $_POST['html'] );
  3020 		$html = stripslashes_deep( $_POST['html'] );
  2709 	} else {
  3021 	} else {
  2710 		$html = isset( $attachment['post_title'] ) ? $attachment['post_title'] : '';
  3022 		$html = isset( $attachment['post_title'] ) ? $attachment['post_title'] : '';
  2711 		$rel = $rel ? ' rel="attachment wp-att-' . $id . '"' : ''; // Hard-coded string, $id is already sanitized
  3023 		$rel  = $rel ? ' rel="attachment wp-att-' . $id . '"' : ''; // Hard-coded string, $id is already sanitized
  2712 
  3024 
  2713 		if ( ! empty( $url ) ) {
  3025 		if ( ! empty( $url ) ) {
  2714 			$html = '<a href="' . esc_url( $url ) . '"' . $rel . '>' . $html . '</a>';
  3026 			$html = '<a href="' . esc_url( $url ) . '"' . $rel . '>' . $html . '</a>';
  2715 		}
  3027 		}
  2716 	}
  3028 	}
  2739 function wp_ajax_send_link_to_editor() {
  3051 function wp_ajax_send_link_to_editor() {
  2740 	global $post, $wp_embed;
  3052 	global $post, $wp_embed;
  2741 
  3053 
  2742 	check_ajax_referer( 'media-send-to-editor', 'nonce' );
  3054 	check_ajax_referer( 'media-send-to-editor', 'nonce' );
  2743 
  3055 
  2744 	if ( ! $src = wp_unslash( $_POST['src'] ) )
  3056 	if ( ! $src = wp_unslash( $_POST['src'] ) ) {
  2745 		wp_send_json_error();
  3057 		wp_send_json_error();
  2746 
  3058 	}
  2747 	if ( ! strpos( $src, '://' ) )
  3059 
       
  3060 	if ( ! strpos( $src, '://' ) ) {
  2748 		$src = 'http://' . $src;
  3061 		$src = 'http://' . $src;
  2749 
  3062 	}
  2750 	if ( ! $src = esc_url_raw( $src ) )
  3063 
       
  3064 	if ( ! $src = esc_url_raw( $src ) ) {
  2751 		wp_send_json_error();
  3065 		wp_send_json_error();
  2752 
  3066 	}
  2753 	if ( ! $link_text = trim( wp_unslash( $_POST['link_text'] ) ) )
  3067 
       
  3068 	if ( ! $link_text = trim( wp_unslash( $_POST['link_text'] ) ) ) {
  2754 		$link_text = wp_basename( $src );
  3069 		$link_text = wp_basename( $src );
       
  3070 	}
  2755 
  3071 
  2756 	$post = get_post( isset( $_POST['post_id'] ) ? $_POST['post_id'] : 0 );
  3072 	$post = get_post( isset( $_POST['post_id'] ) ? $_POST['post_id'] : 0 );
  2757 
  3073 
  2758 	// Ping WordPress for an embed.
  3074 	// Ping WordPress for an embed.
  2759 	$check_embed = $wp_embed->run_shortcode( '[embed]'. $src .'[/embed]' );
  3075 	$check_embed = $wp_embed->run_shortcode( '[embed]' . $src . '[/embed]' );
  2760 
  3076 
  2761 	// Fallback that WordPress creates when no oEmbed was found.
  3077 	// Fallback that WordPress creates when no oEmbed was found.
  2762 	$fallback = $wp_embed->maybe_make_link( $src );
  3078 	$fallback = $wp_embed->maybe_make_link( $src );
  2763 
  3079 
  2764 	if ( $check_embed !== $fallback ) {
  3080 	if ( $check_embed !== $fallback ) {
  2771 	}
  3087 	}
  2772 
  3088 
  2773 	// Figure out what filter to run:
  3089 	// Figure out what filter to run:
  2774 	$type = 'file';
  3090 	$type = 'file';
  2775 	if ( ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) ) && ( $ext_type = wp_ext2type( $ext ) )
  3091 	if ( ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) ) && ( $ext_type = wp_ext2type( $ext ) )
  2776 		&& ( 'audio' == $ext_type || 'video' == $ext_type ) )
  3092 		&& ( 'audio' == $ext_type || 'video' == $ext_type ) ) {
  2777 			$type = $ext_type;
  3093 			$type = $ext_type;
       
  3094 	}
  2778 
  3095 
  2779 	/** This filter is documented in wp-admin/includes/media.php */
  3096 	/** This filter is documented in wp-admin/includes/media.php */
  2780 	$html = apply_filters( "{$type}_send_to_editor_url", $html, $src, $link_text );
  3097 	$html = apply_filters( "{$type}_send_to_editor_url", $html, $src, $link_text );
  2781 
  3098 
  2782 	wp_send_json_success( $html );
  3099 	wp_send_json_success( $html );
  2792 function wp_ajax_heartbeat() {
  3109 function wp_ajax_heartbeat() {
  2793 	if ( empty( $_POST['_nonce'] ) ) {
  3110 	if ( empty( $_POST['_nonce'] ) ) {
  2794 		wp_send_json_error();
  3111 		wp_send_json_error();
  2795 	}
  3112 	}
  2796 
  3113 
  2797 	$response = $data = array();
  3114 	$response    = $data = array();
  2798 	$nonce_state = wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' );
  3115 	$nonce_state = wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' );
  2799 
  3116 
  2800 	// screen_id is the same as $current_screen->id and the JS global 'pagenow'.
  3117 	// screen_id is the same as $current_screen->id and the JS global 'pagenow'.
  2801 	if ( ! empty( $_POST['screen_id'] ) ) {
  3118 	if ( ! empty( $_POST['screen_id'] ) ) {
  2802 		$screen_id = sanitize_key($_POST['screen_id']);
  3119 		$screen_id = sanitize_key( $_POST['screen_id'] );
  2803 	} else {
  3120 	} else {
  2804 		$screen_id = 'front';
  3121 		$screen_id = 'front';
  2805 	}
  3122 	}
  2806 
  3123 
  2807 	if ( ! empty( $_POST['data'] ) ) {
  3124 	if ( ! empty( $_POST['data'] ) ) {
  2808 		$data = wp_unslash( (array) $_POST['data'] );
  3125 		$data = wp_unslash( (array) $_POST['data'] );
  2809 	}
  3126 	}
  2810 
  3127 
  2811 	if ( 1 !== $nonce_state ) {
  3128 	if ( 1 !== $nonce_state ) {
       
  3129 		/**
       
  3130 		 * Filters the nonces to send to the New/Edit Post screen.
       
  3131 		 *
       
  3132 		 * @since 4.3.0
       
  3133 		 *
       
  3134 		 * @param array  $response  The Heartbeat response.
       
  3135 		 * @param array  $data      The $_POST data sent.
       
  3136 		 * @param string $screen_id The screen id.
       
  3137 		 */
  2812 		$response = apply_filters( 'wp_refresh_nonces', $response, $data, $screen_id );
  3138 		$response = apply_filters( 'wp_refresh_nonces', $response, $data, $screen_id );
  2813 
  3139 
  2814 		if ( false === $nonce_state ) {
  3140 		if ( false === $nonce_state ) {
  2815 			// User is logged in but nonces have expired.
  3141 			// User is logged in but nonces have expired.
  2816 			$response['nonces_expired'] = true;
  3142 			$response['nonces_expired'] = true;
  2865  * @since 3.6.0
  3191  * @since 3.6.0
  2866  */
  3192  */
  2867 function wp_ajax_get_revision_diffs() {
  3193 function wp_ajax_get_revision_diffs() {
  2868 	require ABSPATH . 'wp-admin/includes/revision.php';
  3194 	require ABSPATH . 'wp-admin/includes/revision.php';
  2869 
  3195 
  2870 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
  3196 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) ) {
  2871 		wp_send_json_error();
  3197 		wp_send_json_error();
  2872 
  3198 	}
  2873 	if ( ! current_user_can( 'edit_post', $post->ID ) )
  3199 
       
  3200 	if ( ! current_user_can( 'edit_post', $post->ID ) ) {
  2874 		wp_send_json_error();
  3201 		wp_send_json_error();
       
  3202 	}
  2875 
  3203 
  2876 	// Really just pre-loading the cache here.
  3204 	// Really just pre-loading the cache here.
  2877 	if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) )
  3205 	if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) ) {
  2878 		wp_send_json_error();
  3206 		wp_send_json_error();
       
  3207 	}
  2879 
  3208 
  2880 	$return = array();
  3209 	$return = array();
  2881 	@set_time_limit( 0 );
  3210 	@set_time_limit( 0 );
  2882 
  3211 
  2883 	foreach ( $_REQUEST['compare'] as $compare_key ) {
  3212 	foreach ( $_REQUEST['compare'] as $compare_key ) {
  2884 		list( $compare_from, $compare_to ) = explode( ':', $compare_key ); // from:to
  3213 		list( $compare_from, $compare_to ) = explode( ':', $compare_key ); // from:to
  2885 
  3214 
  2886 		$return[] = array(
  3215 		$return[] = array(
  2887 			'id' => $compare_key,
  3216 			'id'     => $compare_key,
  2888 			'fields' => wp_get_revision_ui_diff( $post, $compare_from, $compare_to ),
  3217 			'fields' => wp_get_revision_ui_diff( $post, $compare_from, $compare_to ),
  2889 		);
  3218 		);
  2890 	}
  3219 	}
  2891 	wp_send_json_success( $return );
  3220 	wp_send_json_success( $return );
  2892 }
  3221 }
  2911 	}
  3240 	}
  2912 
  3241 
  2913 	$previous_color_scheme = get_user_meta( get_current_user_id(), 'admin_color', true );
  3242 	$previous_color_scheme = get_user_meta( get_current_user_id(), 'admin_color', true );
  2914 	update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
  3243 	update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
  2915 
  3244 
  2916 	wp_send_json_success( array(
  3245 	wp_send_json_success(
  2917 		'previousScheme' => 'admin-color-' . $previous_color_scheme,
  3246 		array(
  2918 		'currentScheme'  => 'admin-color-' . $color_scheme
  3247 			'previousScheme' => 'admin-color-' . $previous_color_scheme,
  2919 	) );
  3248 			'currentScheme'  => 'admin-color-' . $color_scheme,
       
  3249 		)
       
  3250 	);
  2920 }
  3251 }
  2921 
  3252 
  2922 /**
  3253 /**
  2923  * Ajax handler for getting themes from themes_api().
  3254  * Ajax handler for getting themes from themes_api().
  2924  *
  3255  *
  2932 
  3263 
  2933 	if ( ! current_user_can( 'install_themes' ) ) {
  3264 	if ( ! current_user_can( 'install_themes' ) ) {
  2934 		wp_send_json_error();
  3265 		wp_send_json_error();
  2935 	}
  3266 	}
  2936 
  3267 
  2937 	$args = wp_parse_args( wp_unslash( $_REQUEST['request'] ), array(
  3268 	$args = wp_parse_args(
  2938 		'per_page' => 20,
  3269 		wp_unslash( $_REQUEST['request'] ),
  2939 		'fields'   => $theme_field_defaults
  3270 		array(
  2940 	) );
  3271 			'per_page' => 20,
       
  3272 			'fields'   => array_merge(
       
  3273 				(array) $theme_field_defaults,
       
  3274 				array(
       
  3275 					'reviews_url' => true, // Explicitly request the reviews URL to be linked from the Add Themes screen.
       
  3276 				)
       
  3277 			),
       
  3278 		)
       
  3279 	);
  2941 
  3280 
  2942 	if ( isset( $args['browse'] ) && 'favorites' === $args['browse'] && ! isset( $args['user'] ) ) {
  3281 	if ( isset( $args['browse'] ) && 'favorites' === $args['browse'] && ! isset( $args['user'] ) ) {
  2943 		$user = get_user_option( 'wporg_favorites' );
  3282 		$user = get_user_option( 'wporg_favorites' );
  2944 		if ( $user ) {
  3283 		if ( $user ) {
  2945 			$args['user'] = $user;
  3284 			$args['user'] = $user;
  2957 		wp_send_json_error();
  3296 		wp_send_json_error();
  2958 	}
  3297 	}
  2959 
  3298 
  2960 	$update_php = network_admin_url( 'update.php?action=install-theme' );
  3299 	$update_php = network_admin_url( 'update.php?action=install-theme' );
  2961 	foreach ( $api->themes as &$theme ) {
  3300 	foreach ( $api->themes as &$theme ) {
  2962 		$theme->install_url = add_query_arg( array(
  3301 		$theme->install_url = add_query_arg(
  2963 			'theme'    => $theme->slug,
  3302 			array(
  2964 			'_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug )
  3303 				'theme'    => $theme->slug,
  2965 		), $update_php );
  3304 				'_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug ),
       
  3305 			),
       
  3306 			$update_php
       
  3307 		);
  2966 
  3308 
  2967 		if ( current_user_can( 'switch_themes' ) ) {
  3309 		if ( current_user_can( 'switch_themes' ) ) {
  2968 			if ( is_multisite() ) {
  3310 			if ( is_multisite() ) {
  2969 				$theme->activate_url = add_query_arg( array(
  3311 				$theme->activate_url = add_query_arg(
  2970 					'action'   => 'enable',
  3312 					array(
  2971 					'_wpnonce' => wp_create_nonce( 'enable-theme_' . $theme->slug ),
  3313 						'action'   => 'enable',
  2972 					'theme'    => $theme->slug,
  3314 						'_wpnonce' => wp_create_nonce( 'enable-theme_' . $theme->slug ),
  2973 				), network_admin_url( 'themes.php' ) );
  3315 						'theme'    => $theme->slug,
       
  3316 					),
       
  3317 					network_admin_url( 'themes.php' )
       
  3318 				);
  2974 			} else {
  3319 			} else {
  2975 				$theme->activate_url = add_query_arg( array(
  3320 				$theme->activate_url = add_query_arg(
  2976 					'action'     => 'activate',
  3321 					array(
  2977 					'_wpnonce'   => wp_create_nonce( 'switch-theme_' . $theme->slug ),
  3322 						'action'     => 'activate',
  2978 					'stylesheet' => $theme->slug,
  3323 						'_wpnonce'   => wp_create_nonce( 'switch-theme_' . $theme->slug ),
  2979 				), admin_url( 'themes.php' ) );
  3324 						'stylesheet' => $theme->slug,
       
  3325 					),
       
  3326 					admin_url( 'themes.php' )
       
  3327 				);
  2980 			}
  3328 			}
  2981 		}
  3329 		}
  2982 
  3330 
  2983 		if ( ! is_multisite() && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
  3331 		if ( ! is_multisite() && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
  2984 			$theme->customize_url = add_query_arg( array(
  3332 			$theme->customize_url = add_query_arg(
  2985 				'return' => urlencode( network_admin_url( 'theme-install.php', 'relative' ) ),
  3333 				array(
  2986 			), wp_customize_url( $theme->slug ) );
  3334 					'return' => urlencode( network_admin_url( 'theme-install.php', 'relative' ) ),
       
  3335 				),
       
  3336 				wp_customize_url( $theme->slug )
       
  3337 			);
  2987 		}
  3338 		}
  2988 
  3339 
  2989 		$theme->name        = wp_kses( $theme->name, $themes_allowedtags );
  3340 		$theme->name        = wp_kses( $theme->name, $themes_allowedtags );
  2990 		$theme->author      = wp_kses( $theme->author, $themes_allowedtags );
  3341 		$theme->author      = wp_kses( $theme->author['display_name'], $themes_allowedtags );
  2991 		$theme->version     = wp_kses( $theme->version, $themes_allowedtags );
  3342 		$theme->version     = wp_kses( $theme->version, $themes_allowedtags );
  2992 		$theme->description = wp_kses( $theme->description, $themes_allowedtags );
  3343 		$theme->description = wp_kses( $theme->description, $themes_allowedtags );
  2993 		$theme->stars       = wp_star_rating( array( 'rating' => $theme->rating, 'type' => 'percent', 'number' => $theme->num_ratings, 'echo' => false ) );
  3344 		$theme->stars       = wp_star_rating(
       
  3345 			array(
       
  3346 				'rating' => $theme->rating,
       
  3347 				'type'   => 'percent',
       
  3348 				'number' => $theme->num_ratings,
       
  3349 				'echo'   => false,
       
  3350 			)
       
  3351 		);
  2994 		$theme->num_ratings = number_format_i18n( $theme->num_ratings );
  3352 		$theme->num_ratings = number_format_i18n( $theme->num_ratings );
  2995 		$theme->preview_url = set_url_scheme( $theme->preview_url );
  3353 		$theme->preview_url = set_url_scheme( $theme->preview_url );
  2996 	}
  3354 	}
  2997 
  3355 
  2998 	wp_send_json_success( $api );
  3356 	wp_send_json_success( $api );
  3012 	global $post, $wp_embed, $content_width;
  3370 	global $post, $wp_embed, $content_width;
  3013 
  3371 
  3014 	if ( empty( $_POST['shortcode'] ) ) {
  3372 	if ( empty( $_POST['shortcode'] ) ) {
  3015 		wp_send_json_error();
  3373 		wp_send_json_error();
  3016 	}
  3374 	}
  3017 	$post_id = isset( $_POST[ 'post_ID' ] ) ? intval( $_POST[ 'post_ID' ] ) : 0;
  3375 	$post_id = isset( $_POST['post_ID'] ) ? intval( $_POST['post_ID'] ) : 0;
  3018 	if ( $post_id > 0 ) {
  3376 	if ( $post_id > 0 ) {
  3019 		$post = get_post( $post_id );
  3377 		$post = get_post( $post_id );
  3020 		if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) {
  3378 		if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) {
  3021 			wp_send_json_error();
  3379 			wp_send_json_error();
  3022 		}
  3380 		}
  3035 		$url = $atts['src'];
  3393 		$url = $atts['src'];
  3036 	} else {
  3394 	} else {
  3037 		$url = '';
  3395 		$url = '';
  3038 	}
  3396 	}
  3039 
  3397 
  3040 	$parsed = false;
  3398 	$parsed                         = false;
  3041 	$wp_embed->return_false_on_fail = true;
  3399 	$wp_embed->return_false_on_fail = true;
  3042 
  3400 
  3043 	if ( 0 === $post_id ) {
  3401 	if ( 0 === $post_id ) {
  3044 		/*
  3402 		/*
  3045 		 * Refresh oEmbeds cached outside of posts that are past their TTL.
  3403 		 * Refresh oEmbeds cached outside of posts that are past their TTL.
  3051 
  3409 
  3052 	if ( is_ssl() && 0 === strpos( $url, 'http://' ) ) {
  3410 	if ( is_ssl() && 0 === strpos( $url, 'http://' ) ) {
  3053 		// Admin is ssl and the user pasted non-ssl URL.
  3411 		// Admin is ssl and the user pasted non-ssl URL.
  3054 		// Check if the provider supports ssl embeds and use that for the preview.
  3412 		// Check if the provider supports ssl embeds and use that for the preview.
  3055 		$ssl_shortcode = preg_replace( '%^(\\[embed[^\\]]*\\])http://%i', '$1https://', $shortcode );
  3413 		$ssl_shortcode = preg_replace( '%^(\\[embed[^\\]]*\\])http://%i', '$1https://', $shortcode );
  3056 		$parsed = $wp_embed->run_shortcode( $ssl_shortcode );
  3414 		$parsed        = $wp_embed->run_shortcode( $ssl_shortcode );
  3057 
  3415 
  3058 		if ( ! $parsed ) {
  3416 		if ( ! $parsed ) {
  3059 			$no_ssl_support = true;
  3417 			$no_ssl_support = true;
  3060 		}
  3418 		}
  3061 	}
  3419 	}
  3072 	if ( $url && ! $parsed ) {
  3430 	if ( $url && ! $parsed ) {
  3073 		$parsed = $wp_embed->run_shortcode( $shortcode );
  3431 		$parsed = $wp_embed->run_shortcode( $shortcode );
  3074 	}
  3432 	}
  3075 
  3433 
  3076 	if ( ! $parsed ) {
  3434 	if ( ! $parsed ) {
  3077 		wp_send_json_error( array(
  3435 		wp_send_json_error(
  3078 			'type' => 'not-embeddable',
  3436 			array(
  3079 			'message' => sprintf( __( '%s failed to embed.' ), '<code>' . esc_html( $url ) . '</code>' ),
  3437 				'type'    => 'not-embeddable',
  3080 		) );
  3438 				/* translators: %s: URL which cannot be embedded, between code tags */
       
  3439 				'message' => sprintf( __( '%s failed to embed.' ), '<code>' . esc_html( $url ) . '</code>' ),
       
  3440 			)
       
  3441 		);
  3081 	}
  3442 	}
  3082 
  3443 
  3083 	if ( has_shortcode( $parsed, 'audio' ) || has_shortcode( $parsed, 'video' ) ) {
  3444 	if ( has_shortcode( $parsed, 'audio' ) || has_shortcode( $parsed, 'video' ) ) {
  3084 		$styles = '';
  3445 		$styles     = '';
  3085 		$mce_styles = wpview_media_sandbox_styles();
  3446 		$mce_styles = wpview_media_sandbox_styles();
  3086 		foreach ( $mce_styles as $style ) {
  3447 		foreach ( $mce_styles as $style ) {
  3087 			$styles .= sprintf( '<link rel="stylesheet" href="%s"/>', $style );
  3448 			$styles .= sprintf( '<link rel="stylesheet" href="%s"/>', $style );
  3088 		}
  3449 		}
  3089 
  3450 
  3101 	}
  3462 	}
  3102 
  3463 
  3103 	if ( ! empty( $no_ssl_support ) || ( is_ssl() && ( preg_match( '%<(iframe|script|embed) [^>]*src="http://%', $parsed ) ||
  3464 	if ( ! empty( $no_ssl_support ) || ( is_ssl() && ( preg_match( '%<(iframe|script|embed) [^>]*src="http://%', $parsed ) ||
  3104 		preg_match( '%<link [^>]*href="http://%', $parsed ) ) ) ) {
  3465 		preg_match( '%<link [^>]*href="http://%', $parsed ) ) ) ) {
  3105 		// Admin is ssl and the embed is not. Iframes, scripts, and other "active content" will be blocked.
  3466 		// Admin is ssl and the embed is not. Iframes, scripts, and other "active content" will be blocked.
  3106 		wp_send_json_error( array(
  3467 		wp_send_json_error(
  3107 			'type' => 'not-ssl',
  3468 			array(
  3108 			'message' => __( 'This preview is unavailable in the editor.' ),
  3469 				'type'    => 'not-ssl',
  3109 		) );
  3470 				'message' => __( 'This preview is unavailable in the editor.' ),
       
  3471 			)
       
  3472 		);
  3110 	}
  3473 	}
  3111 
  3474 
  3112 	$return = array(
  3475 	$return = array(
  3113 		'body' => $parsed,
  3476 		'body' => $parsed,
  3114 		'attr' => $wp_embed->last_attr
  3477 		'attr' => $wp_embed->last_attr,
  3115 	);
  3478 	);
  3116 
  3479 
  3117 	if ( strpos( $parsed, 'class="wp-embedded-content' ) ) {
  3480 	if ( strpos( $parsed, 'class="wp-embedded-content' ) ) {
  3118 		if ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) {
  3481 		if ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) {
  3119 			$script_src = includes_url( 'js/wp-embed.js' );
  3482 			$script_src = includes_url( 'js/wp-embed.js' );
  3120 		} else {
  3483 		} else {
  3121 			$script_src = includes_url( 'js/wp-embed.min.js' );
  3484 			$script_src = includes_url( 'js/wp-embed.min.js' );
  3122 		}
  3485 		}
  3123 
  3486 
  3124 		$return['head'] = '<script src="' . $script_src . '"></script>';
  3487 		$return['head']    = '<script src="' . $script_src . '"></script>';
  3125 		$return['sandbox'] = true;
  3488 		$return['sandbox'] = true;
  3126 	}
  3489 	}
  3127 
  3490 
  3128 	wp_send_json_success( $return );
  3491 	wp_send_json_success( $return );
  3129 }
  3492 }
  3154 		}
  3517 		}
  3155 	} else {
  3518 	} else {
  3156 		setup_postdata( $post );
  3519 		setup_postdata( $post );
  3157 	}
  3520 	}
  3158 
  3521 
  3159 	$parsed = do_shortcode( $shortcode  );
  3522 	$parsed = do_shortcode( $shortcode );
  3160 
  3523 
  3161 	if ( empty( $parsed ) ) {
  3524 	if ( empty( $parsed ) ) {
  3162 		wp_send_json_error( array(
  3525 		wp_send_json_error(
  3163 			'type' => 'no-items',
  3526 			array(
  3164 			'message' => __( 'No items found.' ),
  3527 				'type'    => 'no-items',
  3165 		) );
  3528 				'message' => __( 'No items found.' ),
  3166 	}
  3529 			)
  3167 
  3530 		);
  3168 	$head = '';
  3531 	}
       
  3532 
       
  3533 	$head   = '';
  3169 	$styles = wpview_media_sandbox_styles();
  3534 	$styles = wpview_media_sandbox_styles();
  3170 
  3535 
  3171 	foreach ( $styles as $style ) {
  3536 	foreach ( $styles as $style ) {
  3172 		$head .= '<link type="text/css" rel="stylesheet" href="' . $style . '">';
  3537 		$head .= '<link type="text/css" rel="stylesheet" href="' . $style . '">';
  3173 	}
  3538 	}
  3186 		wp_print_scripts( 'wp-playlist' );
  3551 		wp_print_scripts( 'wp-playlist' );
  3187 	} else {
  3552 	} else {
  3188 		wp_print_scripts( array( 'mediaelement-vimeo', 'wp-mediaelement' ) );
  3553 		wp_print_scripts( array( 'mediaelement-vimeo', 'wp-mediaelement' ) );
  3189 	}
  3554 	}
  3190 
  3555 
  3191 	wp_send_json_success( array(
  3556 	wp_send_json_success(
  3192 		'head' => $head,
  3557 		array(
  3193 		'body' => ob_get_clean()
  3558 			'head' => $head,
  3194 	) );
  3559 			'body' => ob_get_clean(),
       
  3560 		)
       
  3561 	);
  3195 }
  3562 }
  3196 
  3563 
  3197 /**
  3564 /**
  3198  * Ajax handler for destroying multiple open sessions for a user.
  3565  * Ajax handler for destroying multiple open sessions for a user.
  3199  *
  3566  *
  3208 			$user = false;
  3575 			$user = false;
  3209 		}
  3576 		}
  3210 	}
  3577 	}
  3211 
  3578 
  3212 	if ( ! $user ) {
  3579 	if ( ! $user ) {
  3213 		wp_send_json_error( array(
  3580 		wp_send_json_error(
  3214 			'message' => __( 'Could not log out user sessions. Please try again.' ),
  3581 			array(
  3215 		) );
  3582 				'message' => __( 'Could not log out user sessions. Please try again.' ),
       
  3583 			)
       
  3584 		);
  3216 	}
  3585 	}
  3217 
  3586 
  3218 	$sessions = WP_Session_Tokens::get_instance( $user->ID );
  3587 	$sessions = WP_Session_Tokens::get_instance( $user->ID );
  3219 
  3588 
  3220 	if ( $user->ID === get_current_user_id() ) {
  3589 	if ( $user->ID === get_current_user_id() ) {
  3250 		wp_send_json_error( array( 'message' => __( 'Image could not be processed.' ) ) );
  3619 		wp_send_json_error( array( 'message' => __( 'Image could not be processed.' ) ) );
  3251 	}
  3620 	}
  3252 
  3621 
  3253 	switch ( $context ) {
  3622 	switch ( $context ) {
  3254 		case 'site-icon':
  3623 		case 'site-icon':
  3255 			require_once ABSPATH . '/wp-admin/includes/class-wp-site-icon.php';
  3624 			require_once ABSPATH . 'wp-admin/includes/class-wp-site-icon.php';
  3256 			$wp_site_icon = new WP_Site_Icon();
  3625 			$wp_site_icon = new WP_Site_Icon();
  3257 
  3626 
  3258 			// Skip creating a new attachment if the attachment is a Site Icon.
  3627 			// Skip creating a new attachment if the attachment is a Site Icon.
  3259 			if ( get_post_meta( $attachment_id, '_wp_attachment_context', true ) == $context ) {
  3628 			if ( get_post_meta( $attachment_id, '_wp_attachment_context', true ) == $context ) {
  3260 
  3629 
  3279 			// Additional sizes in wp_prepare_attachment_for_js().
  3648 			// Additional sizes in wp_prepare_attachment_for_js().
  3280 			add_filter( 'image_size_names_choose', array( $wp_site_icon, 'additional_sizes' ) );
  3649 			add_filter( 'image_size_names_choose', array( $wp_site_icon, 'additional_sizes' ) );
  3281 			break;
  3650 			break;
  3282 
  3651 
  3283 		default:
  3652 		default:
  3284 
       
  3285 			/**
  3653 			/**
  3286 			 * Fires before a cropped image is saved.
  3654 			 * Fires before a cropped image is saved.
  3287 			 *
  3655 			 *
  3288 			 * Allows to add filters to modify the way a cropped image is saved.
  3656 			 * Allows to add filters to modify the way a cropped image is saved.
  3289 			 *
  3657 			 *
  3297 
  3665 
  3298 			/** This filter is documented in wp-admin/custom-header.php */
  3666 			/** This filter is documented in wp-admin/custom-header.php */
  3299 			$cropped = apply_filters( 'wp_create_file_in_uploads', $cropped, $attachment_id ); // For replication.
  3667 			$cropped = apply_filters( 'wp_create_file_in_uploads', $cropped, $attachment_id ); // For replication.
  3300 
  3668 
  3301 			$parent_url = wp_get_attachment_url( $attachment_id );
  3669 			$parent_url = wp_get_attachment_url( $attachment_id );
  3302 			$url        = str_replace( basename( $parent_url ), basename( $cropped ), $parent_url );
  3670 			$url        = str_replace( wp_basename( $parent_url ), wp_basename( $cropped ), $parent_url );
  3303 
  3671 
  3304 			$size       = @getimagesize( $cropped );
  3672 			$size       = @getimagesize( $cropped );
  3305 			$image_type = ( $size ) ? $size['mime'] : 'image/jpeg';
  3673 			$image_type = ( $size ) ? $size['mime'] : 'image/jpeg';
  3306 
  3674 
  3307 			$object = array(
  3675 			$object = array(
  3308 				'post_title'     => basename( $cropped ),
  3676 				'post_title'     => wp_basename( $cropped ),
  3309 				'post_content'   => $url,
  3677 				'post_content'   => $url,
  3310 				'post_mime_type' => $image_type,
  3678 				'post_mime_type' => $image_type,
  3311 				'guid'           => $url,
  3679 				'guid'           => $url,
  3312 				'context'        => $context,
  3680 				'context'        => $context,
  3313 			);
  3681 			);
  3314 
  3682 
  3315 			$attachment_id = wp_insert_attachment( $object, $cropped );
  3683 			$attachment_id = wp_insert_attachment( $object, $cropped );
  3316 			$metadata = wp_generate_attachment_metadata( $attachment_id, $cropped );
  3684 			$metadata      = wp_generate_attachment_metadata( $attachment_id, $cropped );
  3317 
  3685 
  3318 			/**
  3686 			/**
  3319 			 * Filters the cropped image attachment metadata.
  3687 			 * Filters the cropped image attachment metadata.
  3320 			 *
  3688 			 *
  3321 			 * @since 4.3.0
  3689 			 * @since 4.3.0
  3376  *
  3744  *
  3377  * @since 4.6.0
  3745  * @since 4.6.0
  3378  *
  3746  *
  3379  * @see Theme_Upgrader
  3747  * @see Theme_Upgrader
  3380  *
  3748  *
  3381  * @global WP_Filesystem_Base $wp_filesystem Subclass
  3749  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3382  */
  3750  */
  3383 function wp_ajax_install_theme() {
  3751 function wp_ajax_install_theme() {
  3384 	check_ajax_referer( 'updates' );
  3752 	check_ajax_referer( 'updates' );
  3385 
  3753 
  3386 	if ( empty( $_POST['slug'] ) ) {
  3754 	if ( empty( $_POST['slug'] ) ) {
  3387 		wp_send_json_error( array(
  3755 		wp_send_json_error(
  3388 			'slug'         => '',
  3756 			array(
  3389 			'errorCode'    => 'no_theme_specified',
  3757 				'slug'         => '',
  3390 			'errorMessage' => __( 'No theme specified.' ),
  3758 				'errorCode'    => 'no_theme_specified',
  3391 		) );
  3759 				'errorMessage' => __( 'No theme specified.' ),
       
  3760 			)
       
  3761 		);
  3392 	}
  3762 	}
  3393 
  3763 
  3394 	$slug = sanitize_key( wp_unslash( $_POST['slug'] ) );
  3764 	$slug = sanitize_key( wp_unslash( $_POST['slug'] ) );
  3395 
  3765 
  3396 	$status = array(
  3766 	$status = array(
  3404 	}
  3774 	}
  3405 
  3775 
  3406 	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
  3776 	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
  3407 	include_once( ABSPATH . 'wp-admin/includes/theme.php' );
  3777 	include_once( ABSPATH . 'wp-admin/includes/theme.php' );
  3408 
  3778 
  3409 	$api = themes_api( 'theme_information', array(
  3779 	$api = themes_api(
  3410 		'slug'   => $slug,
  3780 		'theme_information',
  3411 		'fields' => array( 'sections' => false ),
  3781 		array(
  3412 	) );
  3782 			'slug'   => $slug,
       
  3783 			'fields' => array( 'sections' => false ),
       
  3784 		)
       
  3785 	);
  3413 
  3786 
  3414 	if ( is_wp_error( $api ) ) {
  3787 	if ( is_wp_error( $api ) ) {
  3415 		$status['errorMessage'] = $api->get_error_message();
  3788 		$status['errorMessage'] = $api->get_error_message();
  3416 		wp_send_json_error( $status );
  3789 		wp_send_json_error( $status );
  3417 	}
  3790 	}
  3430 		wp_send_json_error( $status );
  3803 		wp_send_json_error( $status );
  3431 	} elseif ( is_wp_error( $skin->result ) ) {
  3804 	} elseif ( is_wp_error( $skin->result ) ) {
  3432 		$status['errorCode']    = $skin->result->get_error_code();
  3805 		$status['errorCode']    = $skin->result->get_error_code();
  3433 		$status['errorMessage'] = $skin->result->get_error_message();
  3806 		$status['errorMessage'] = $skin->result->get_error_message();
  3434 		wp_send_json_error( $status );
  3807 		wp_send_json_error( $status );
  3435 	} elseif ( $skin->get_errors()->get_error_code() ) {
  3808 	} elseif ( $skin->get_errors()->has_errors() ) {
  3436 		$status['errorMessage'] = $skin->get_error_messages();
  3809 		$status['errorMessage'] = $skin->get_error_messages();
  3437 		wp_send_json_error( $status );
  3810 		wp_send_json_error( $status );
  3438 	} elseif ( is_null( $result ) ) {
  3811 	} elseif ( is_null( $result ) ) {
  3439 		global $wp_filesystem;
  3812 		global $wp_filesystem;
  3440 
  3813 
  3441 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3814 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3442 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3815 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3443 
  3816 
  3444 		// Pass through the error from WP_Filesystem if one was raised.
  3817 		// Pass through the error from WP_Filesystem if one was raised.
  3445 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  3818 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3446 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3819 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3447 		}
  3820 		}
  3448 
  3821 
  3449 		wp_send_json_error( $status );
  3822 		wp_send_json_error( $status );
  3450 	}
  3823 	}
  3451 
  3824 
  3452 	$status['themeName'] = wp_get_theme( $slug )->get( 'Name' );
  3825 	$status['themeName'] = wp_get_theme( $slug )->get( 'Name' );
  3453 
  3826 
  3454 	if ( current_user_can( 'switch_themes' ) ) {
  3827 	if ( current_user_can( 'switch_themes' ) ) {
  3455 		if ( is_multisite() ) {
  3828 		if ( is_multisite() ) {
  3456 			$status['activateUrl'] = add_query_arg( array(
  3829 			$status['activateUrl'] = add_query_arg(
  3457 				'action'   => 'enable',
  3830 				array(
  3458 				'_wpnonce' => wp_create_nonce( 'enable-theme_' . $slug ),
  3831 					'action'   => 'enable',
  3459 				'theme'    => $slug,
  3832 					'_wpnonce' => wp_create_nonce( 'enable-theme_' . $slug ),
  3460 			), network_admin_url( 'themes.php' ) );
  3833 					'theme'    => $slug,
       
  3834 				),
       
  3835 				network_admin_url( 'themes.php' )
       
  3836 			);
  3461 		} else {
  3837 		} else {
  3462 			$status['activateUrl'] = add_query_arg( array(
  3838 			$status['activateUrl'] = add_query_arg(
  3463 				'action'     => 'activate',
  3839 				array(
  3464 				'_wpnonce'   => wp_create_nonce( 'switch-theme_' . $slug ),
  3840 					'action'     => 'activate',
  3465 				'stylesheet' => $slug,
  3841 					'_wpnonce'   => wp_create_nonce( 'switch-theme_' . $slug ),
  3466 			), admin_url( 'themes.php' ) );
  3842 					'stylesheet' => $slug,
       
  3843 				),
       
  3844 				admin_url( 'themes.php' )
       
  3845 			);
  3467 		}
  3846 		}
  3468 	}
  3847 	}
  3469 
  3848 
  3470 	if ( ! is_multisite() && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
  3849 	if ( ! is_multisite() && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
  3471 		$status['customizeUrl'] = add_query_arg( array(
  3850 		$status['customizeUrl'] = add_query_arg(
  3472 			'return' => urlencode( network_admin_url( 'theme-install.php', 'relative' ) ),
  3851 			array(
  3473 		), wp_customize_url( $slug ) );
  3852 				'return' => urlencode( network_admin_url( 'theme-install.php', 'relative' ) ),
       
  3853 			),
       
  3854 			wp_customize_url( $slug )
       
  3855 		);
  3474 	}
  3856 	}
  3475 
  3857 
  3476 	/*
  3858 	/*
  3477 	 * See WP_Theme_Install_List_Table::_get_theme_status() if we wanted to check
  3859 	 * See WP_Theme_Install_List_Table::_get_theme_status() if we wanted to check
  3478 	 * on post-installation status.
  3860 	 * on post-installation status.
  3485  *
  3867  *
  3486  * @since 4.6.0
  3868  * @since 4.6.0
  3487  *
  3869  *
  3488  * @see Theme_Upgrader
  3870  * @see Theme_Upgrader
  3489  *
  3871  *
  3490  * @global WP_Filesystem_Base $wp_filesystem Subclass
  3872  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3491  */
  3873  */
  3492 function wp_ajax_update_theme() {
  3874 function wp_ajax_update_theme() {
  3493 	check_ajax_referer( 'updates' );
  3875 	check_ajax_referer( 'updates' );
  3494 
  3876 
  3495 	if ( empty( $_POST['slug'] ) ) {
  3877 	if ( empty( $_POST['slug'] ) ) {
  3496 		wp_send_json_error( array(
  3878 		wp_send_json_error(
  3497 			'slug'         => '',
  3879 			array(
  3498 			'errorCode'    => 'no_theme_specified',
  3880 				'slug'         => '',
  3499 			'errorMessage' => __( 'No theme specified.' ),
  3881 				'errorCode'    => 'no_theme_specified',
  3500 		) );
  3882 				'errorMessage' => __( 'No theme specified.' ),
       
  3883 			)
       
  3884 		);
  3501 	}
  3885 	}
  3502 
  3886 
  3503 	$stylesheet = preg_replace( '/[^A-z0-9_\-]/', '', wp_unslash( $_POST['slug'] ) );
  3887 	$stylesheet = preg_replace( '/[^A-z0-9_\-]/', '', wp_unslash( $_POST['slug'] ) );
  3504 	$status     = array(
  3888 	$status     = array(
  3505 		'update'     => 'theme',
  3889 		'update'     => 'theme',
  3535 
  3919 
  3536 	if ( is_wp_error( $skin->result ) ) {
  3920 	if ( is_wp_error( $skin->result ) ) {
  3537 		$status['errorCode']    = $skin->result->get_error_code();
  3921 		$status['errorCode']    = $skin->result->get_error_code();
  3538 		$status['errorMessage'] = $skin->result->get_error_message();
  3922 		$status['errorMessage'] = $skin->result->get_error_message();
  3539 		wp_send_json_error( $status );
  3923 		wp_send_json_error( $status );
  3540 	} elseif ( $skin->get_errors()->get_error_code() ) {
  3924 	} elseif ( $skin->get_errors()->has_errors() ) {
  3541 		$status['errorMessage'] = $skin->get_error_messages();
  3925 		$status['errorMessage'] = $skin->get_error_messages();
  3542 		wp_send_json_error( $status );
  3926 		wp_send_json_error( $status );
  3543 	} elseif ( is_array( $result ) && ! empty( $result[ $stylesheet ] ) ) {
  3927 	} elseif ( is_array( $result ) && ! empty( $result[ $stylesheet ] ) ) {
  3544 
  3928 
  3545 		// Theme is already at the latest version.
  3929 		// Theme is already at the latest version.
  3559 
  3943 
  3560 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3944 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3561 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3945 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3562 
  3946 
  3563 		// Pass through the error from WP_Filesystem if one was raised.
  3947 		// Pass through the error from WP_Filesystem if one was raised.
  3564 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  3948 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3565 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3949 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3566 		}
  3950 		}
  3567 
  3951 
  3568 		wp_send_json_error( $status );
  3952 		wp_send_json_error( $status );
  3569 	}
  3953 	}
  3578  *
  3962  *
  3579  * @since 4.6.0
  3963  * @since 4.6.0
  3580  *
  3964  *
  3581  * @see delete_theme()
  3965  * @see delete_theme()
  3582  *
  3966  *
  3583  * @global WP_Filesystem_Base $wp_filesystem Subclass
  3967  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3584  */
  3968  */
  3585 function wp_ajax_delete_theme() {
  3969 function wp_ajax_delete_theme() {
  3586 	check_ajax_referer( 'updates' );
  3970 	check_ajax_referer( 'updates' );
  3587 
  3971 
  3588 	if ( empty( $_POST['slug'] ) ) {
  3972 	if ( empty( $_POST['slug'] ) ) {
  3589 		wp_send_json_error( array(
  3973 		wp_send_json_error(
  3590 			'slug'         => '',
  3974 			array(
  3591 			'errorCode'    => 'no_theme_specified',
  3975 				'slug'         => '',
  3592 			'errorMessage' => __( 'No theme specified.' ),
  3976 				'errorCode'    => 'no_theme_specified',
  3593 		) );
  3977 				'errorMessage' => __( 'No theme specified.' ),
       
  3978 			)
       
  3979 		);
  3594 	}
  3980 	}
  3595 
  3981 
  3596 	$stylesheet = preg_replace( '/[^A-z0-9_\-]/', '', wp_unslash( $_POST['slug'] ) );
  3982 	$stylesheet = preg_replace( '/[^A-z0-9_\-]/', '', wp_unslash( $_POST['slug'] ) );
  3597 	$status     = array(
  3983 	$status     = array(
  3598 		'delete' => 'theme',
  3984 		'delete' => 'theme',
  3619 
  4005 
  3620 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  4006 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3621 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  4007 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3622 
  4008 
  3623 		// Pass through the error from WP_Filesystem if one was raised.
  4009 		// Pass through the error from WP_Filesystem if one was raised.
  3624 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  4010 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3625 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  4011 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3626 		}
  4012 		}
  3627 
  4013 
  3628 		wp_send_json_error( $status );
  4014 		wp_send_json_error( $status );
  3629 	}
  4015 	}
  3648  *
  4034  *
  3649  * @since 4.6.0
  4035  * @since 4.6.0
  3650  *
  4036  *
  3651  * @see Plugin_Upgrader
  4037  * @see Plugin_Upgrader
  3652  *
  4038  *
  3653  * @global WP_Filesystem_Base $wp_filesystem Subclass
  4039  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3654  */
  4040  */
  3655 function wp_ajax_install_plugin() {
  4041 function wp_ajax_install_plugin() {
  3656 	check_ajax_referer( 'updates' );
  4042 	check_ajax_referer( 'updates' );
  3657 
  4043 
  3658 	if ( empty( $_POST['slug'] ) ) {
  4044 	if ( empty( $_POST['slug'] ) ) {
  3659 		wp_send_json_error( array(
  4045 		wp_send_json_error(
  3660 			'slug'         => '',
  4046 			array(
  3661 			'errorCode'    => 'no_plugin_specified',
  4047 				'slug'         => '',
  3662 			'errorMessage' => __( 'No plugin specified.' ),
  4048 				'errorCode'    => 'no_plugin_specified',
  3663 		) );
  4049 				'errorMessage' => __( 'No plugin specified.' ),
       
  4050 			)
       
  4051 		);
  3664 	}
  4052 	}
  3665 
  4053 
  3666 	$status = array(
  4054 	$status = array(
  3667 		'install' => 'plugin',
  4055 		'install' => 'plugin',
  3668 		'slug'    => sanitize_key( wp_unslash( $_POST['slug'] ) ),
  4056 		'slug'    => sanitize_key( wp_unslash( $_POST['slug'] ) ),
  3674 	}
  4062 	}
  3675 
  4063 
  3676 	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
  4064 	include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
  3677 	include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
  4065 	include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
  3678 
  4066 
  3679 	$api = plugins_api( 'plugin_information', array(
  4067 	$api = plugins_api(
  3680 		'slug'   => sanitize_key( wp_unslash( $_POST['slug'] ) ),
  4068 		'plugin_information',
  3681 		'fields' => array(
  4069 		array(
  3682 			'sections' => false,
  4070 			'slug'   => sanitize_key( wp_unslash( $_POST['slug'] ) ),
  3683 		),
  4071 			'fields' => array(
  3684 	) );
  4072 				'sections' => false,
       
  4073 			),
       
  4074 		)
       
  4075 	);
  3685 
  4076 
  3686 	if ( is_wp_error( $api ) ) {
  4077 	if ( is_wp_error( $api ) ) {
  3687 		$status['errorMessage'] = $api->get_error_message();
  4078 		$status['errorMessage'] = $api->get_error_message();
  3688 		wp_send_json_error( $status );
  4079 		wp_send_json_error( $status );
  3689 	}
  4080 	}
  3704 		wp_send_json_error( $status );
  4095 		wp_send_json_error( $status );
  3705 	} elseif ( is_wp_error( $skin->result ) ) {
  4096 	} elseif ( is_wp_error( $skin->result ) ) {
  3706 		$status['errorCode']    = $skin->result->get_error_code();
  4097 		$status['errorCode']    = $skin->result->get_error_code();
  3707 		$status['errorMessage'] = $skin->result->get_error_message();
  4098 		$status['errorMessage'] = $skin->result->get_error_message();
  3708 		wp_send_json_error( $status );
  4099 		wp_send_json_error( $status );
  3709 	} elseif ( $skin->get_errors()->get_error_code() ) {
  4100 	} elseif ( $skin->get_errors()->has_errors() ) {
  3710 		$status['errorMessage'] = $skin->get_error_messages();
  4101 		$status['errorMessage'] = $skin->get_error_messages();
  3711 		wp_send_json_error( $status );
  4102 		wp_send_json_error( $status );
  3712 	} elseif ( is_null( $result ) ) {
  4103 	} elseif ( is_null( $result ) ) {
  3713 		global $wp_filesystem;
  4104 		global $wp_filesystem;
  3714 
  4105 
  3715 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  4106 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3716 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  4107 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3717 
  4108 
  3718 		// Pass through the error from WP_Filesystem if one was raised.
  4109 		// Pass through the error from WP_Filesystem if one was raised.
  3719 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  4110 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3720 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  4111 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3721 		}
  4112 		}
  3722 
  4113 
  3723 		wp_send_json_error( $status );
  4114 		wp_send_json_error( $status );
  3724 	}
  4115 	}
  3725 
  4116 
  3726 	$install_status = install_plugin_install_status( $api );
  4117 	$install_status = install_plugin_install_status( $api );
  3727 	$pagenow = isset( $_POST['pagenow'] ) ? sanitize_key( $_POST['pagenow'] ) : '';
  4118 	$pagenow        = isset( $_POST['pagenow'] ) ? sanitize_key( $_POST['pagenow'] ) : '';
  3728 
  4119 
  3729 	// If installation request is coming from import page, do not return network activation link.
  4120 	// If installation request is coming from import page, do not return network activation link.
  3730 	$plugins_url = ( 'import' === $pagenow ) ? admin_url( 'plugins.php' ) : network_admin_url( 'plugins.php' );
  4121 	$plugins_url = ( 'import' === $pagenow ) ? admin_url( 'plugins.php' ) : network_admin_url( 'plugins.php' );
  3731 
  4122 
  3732 	if ( current_user_can( 'activate_plugin', $install_status['file'] ) && is_plugin_inactive( $install_status['file'] ) ) {
  4123 	if ( current_user_can( 'activate_plugin', $install_status['file'] ) && is_plugin_inactive( $install_status['file'] ) ) {
  3733 		$status['activateUrl'] = add_query_arg( array(
  4124 		$status['activateUrl'] = add_query_arg(
  3734 			'_wpnonce' => wp_create_nonce( 'activate-plugin_' . $install_status['file'] ),
  4125 			array(
  3735 			'action'   => 'activate',
  4126 				'_wpnonce' => wp_create_nonce( 'activate-plugin_' . $install_status['file'] ),
  3736 			'plugin'   => $install_status['file'],
  4127 				'action'   => 'activate',
  3737 		), $plugins_url );
  4128 				'plugin'   => $install_status['file'],
       
  4129 			),
       
  4130 			$plugins_url
       
  4131 		);
  3738 	}
  4132 	}
  3739 
  4133 
  3740 	if ( is_multisite() && current_user_can( 'manage_network_plugins' ) && 'import' !== $pagenow ) {
  4134 	if ( is_multisite() && current_user_can( 'manage_network_plugins' ) && 'import' !== $pagenow ) {
  3741 		$status['activateUrl'] = add_query_arg( array( 'networkwide' => 1 ), $status['activateUrl'] );
  4135 		$status['activateUrl'] = add_query_arg( array( 'networkwide' => 1 ), $status['activateUrl'] );
  3742 	}
  4136 	}
  3749  *
  4143  *
  3750  * @since 4.2.0
  4144  * @since 4.2.0
  3751  *
  4145  *
  3752  * @see Plugin_Upgrader
  4146  * @see Plugin_Upgrader
  3753  *
  4147  *
  3754  * @global WP_Filesystem_Base $wp_filesystem Subclass
  4148  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3755  */
  4149  */
  3756 function wp_ajax_update_plugin() {
  4150 function wp_ajax_update_plugin() {
  3757 	check_ajax_referer( 'updates' );
  4151 	check_ajax_referer( 'updates' );
  3758 
  4152 
  3759 	if ( empty( $_POST['plugin'] ) || empty( $_POST['slug'] ) ) {
  4153 	if ( empty( $_POST['plugin'] ) || empty( $_POST['slug'] ) ) {
  3760 		wp_send_json_error( array(
  4154 		wp_send_json_error(
  3761 			'slug'         => '',
  4155 			array(
  3762 			'errorCode'    => 'no_plugin_specified',
  4156 				'slug'         => '',
  3763 			'errorMessage' => __( 'No plugin specified.' ),
  4157 				'errorCode'    => 'no_plugin_specified',
  3764 		) );
  4158 				'errorMessage' => __( 'No plugin specified.' ),
       
  4159 			)
       
  4160 		);
  3765 	}
  4161 	}
  3766 
  4162 
  3767 	$plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
  4163 	$plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
  3768 
  4164 
  3769 	$status = array(
  4165 	$status = array(
  3801 
  4197 
  3802 	if ( is_wp_error( $skin->result ) ) {
  4198 	if ( is_wp_error( $skin->result ) ) {
  3803 		$status['errorCode']    = $skin->result->get_error_code();
  4199 		$status['errorCode']    = $skin->result->get_error_code();
  3804 		$status['errorMessage'] = $skin->result->get_error_message();
  4200 		$status['errorMessage'] = $skin->result->get_error_message();
  3805 		wp_send_json_error( $status );
  4201 		wp_send_json_error( $status );
  3806 	} elseif ( $skin->get_errors()->get_error_code() ) {
  4202 	} elseif ( $skin->get_errors()->has_errors() ) {
  3807 		$status['errorMessage'] = $skin->get_error_messages();
  4203 		$status['errorMessage'] = $skin->get_error_messages();
  3808 		wp_send_json_error( $status );
  4204 		wp_send_json_error( $status );
  3809 	} elseif ( is_array( $result ) && ! empty( $result[ $plugin ] ) ) {
  4205 	} elseif ( is_array( $result ) && ! empty( $result[ $plugin ] ) ) {
  3810 		$plugin_update_data = current( $result );
  4206 		$plugin_update_data = current( $result );
  3811 
  4207 
  3835 
  4231 
  3836 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  4232 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3837 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  4233 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3838 
  4234 
  3839 		// Pass through the error from WP_Filesystem if one was raised.
  4235 		// Pass through the error from WP_Filesystem if one was raised.
  3840 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  4236 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3841 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  4237 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3842 		}
  4238 		}
  3843 
  4239 
  3844 		wp_send_json_error( $status );
  4240 		wp_send_json_error( $status );
  3845 	}
  4241 	}
  3854  *
  4250  *
  3855  * @since 4.6.0
  4251  * @since 4.6.0
  3856  *
  4252  *
  3857  * @see delete_plugins()
  4253  * @see delete_plugins()
  3858  *
  4254  *
  3859  * @global WP_Filesystem_Base $wp_filesystem Subclass
  4255  * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  3860  */
  4256  */
  3861 function wp_ajax_delete_plugin() {
  4257 function wp_ajax_delete_plugin() {
  3862 	check_ajax_referer( 'updates' );
  4258 	check_ajax_referer( 'updates' );
  3863 
  4259 
  3864 	if ( empty( $_POST['slug'] ) || empty( $_POST['plugin'] ) ) {
  4260 	if ( empty( $_POST['slug'] ) || empty( $_POST['plugin'] ) ) {
  3865 		wp_send_json_error( array(
  4261 		wp_send_json_error(
  3866 			'slug'         => '',
  4262 			array(
  3867 			'errorCode'    => 'no_plugin_specified',
  4263 				'slug'         => '',
  3868 			'errorMessage' => __( 'No plugin specified.' ),
  4264 				'errorCode'    => 'no_plugin_specified',
  3869 		) );
  4265 				'errorMessage' => __( 'No plugin specified.' ),
       
  4266 			)
       
  4267 		);
  3870 	}
  4268 	}
  3871 
  4269 
  3872 	$plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
  4270 	$plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
  3873 
  4271 
  3874 	$status = array(
  4272 	$status = array(
  3900 
  4298 
  3901 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  4299 		$status['errorCode']    = 'unable_to_connect_to_filesystem';
  3902 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  4300 		$status['errorMessage'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' );
  3903 
  4301 
  3904 		// Pass through the error from WP_Filesystem if one was raised.
  4302 		// Pass through the error from WP_Filesystem if one was raised.
  3905 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->get_error_code() ) {
  4303 		if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {
  3906 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  4304 			$status['errorMessage'] = esc_html( $wp_filesystem->errors->get_error_message() );
  3907 		}
  4305 		}
  3908 
  4306 
  3909 		wp_send_json_error( $status );
  4307 		wp_send_json_error( $status );
  3910 	}
  4308 	}
  3936 	if ( 'plugins-network' === $pagenow || 'plugins' === $pagenow ) {
  4334 	if ( 'plugins-network' === $pagenow || 'plugins' === $pagenow ) {
  3937 		set_current_screen( $pagenow );
  4335 		set_current_screen( $pagenow );
  3938 	}
  4336 	}
  3939 
  4337 
  3940 	/** @var WP_Plugins_List_Table $wp_list_table */
  4338 	/** @var WP_Plugins_List_Table $wp_list_table */
  3941 	$wp_list_table = _get_list_table( 'WP_Plugins_List_Table', array(
  4339 	$wp_list_table = _get_list_table(
  3942 		'screen' => get_current_screen(),
  4340 		'WP_Plugins_List_Table',
  3943 	) );
  4341 		array(
       
  4342 			'screen' => get_current_screen(),
       
  4343 		)
       
  4344 	);
  3944 
  4345 
  3945 	$status = array();
  4346 	$status = array();
  3946 
  4347 
  3947 	if ( ! $wp_list_table->ajax_user_can() ) {
  4348 	if ( ! $wp_list_table->ajax_user_can() ) {
  3948 		$status['errorMessage'] = __( 'Sorry, you are not allowed to manage plugins for this site.' );
  4349 		$status['errorMessage'] = __( 'Sorry, you are not allowed to manage plugins for this site.' );
  3949 		wp_send_json_error( $status );
  4350 		wp_send_json_error( $status );
  3950 	}
  4351 	}
  3951 
  4352 
  3952 	// Set the correct requester, so pagination works.
  4353 	// Set the correct requester, so pagination works.
  3953 	$_SERVER['REQUEST_URI'] = add_query_arg( array_diff_key( $_POST, array(
  4354 	$_SERVER['REQUEST_URI'] = add_query_arg(
  3954 		'_ajax_nonce' => null,
  4355 		array_diff_key(
  3955 		'action'      => null,
  4356 			$_POST,
  3956 	) ), network_admin_url( 'plugins.php', 'relative' ) );
  4357 			array(
       
  4358 				'_ajax_nonce' => null,
       
  4359 				'action'      => null,
       
  4360 			)
       
  4361 		),
       
  4362 		network_admin_url( 'plugins.php', 'relative' )
       
  4363 	);
  3957 
  4364 
  3958 	$GLOBALS['s'] = wp_unslash( $_POST['s'] );
  4365 	$GLOBALS['s'] = wp_unslash( $_POST['s'] );
  3959 
  4366 
  3960 	$wp_list_table->prepare_items();
  4367 	$wp_list_table->prepare_items();
  3961 
  4368 
  3979 	if ( 'plugin-install-network' === $pagenow || 'plugin-install' === $pagenow ) {
  4386 	if ( 'plugin-install-network' === $pagenow || 'plugin-install' === $pagenow ) {
  3980 		set_current_screen( $pagenow );
  4387 		set_current_screen( $pagenow );
  3981 	}
  4388 	}
  3982 
  4389 
  3983 	/** @var WP_Plugin_Install_List_Table $wp_list_table */
  4390 	/** @var WP_Plugin_Install_List_Table $wp_list_table */
  3984 	$wp_list_table = _get_list_table( 'WP_Plugin_Install_List_Table', array(
  4391 	$wp_list_table = _get_list_table(
  3985 		'screen' => get_current_screen(),
  4392 		'WP_Plugin_Install_List_Table',
  3986 	) );
  4393 		array(
       
  4394 			'screen' => get_current_screen(),
       
  4395 		)
       
  4396 	);
  3987 
  4397 
  3988 	$status = array();
  4398 	$status = array();
  3989 
  4399 
  3990 	if ( ! $wp_list_table->ajax_user_can() ) {
  4400 	if ( ! $wp_list_table->ajax_user_can() ) {
  3991 		$status['errorMessage'] = __( 'Sorry, you are not allowed to manage plugins for this site.' );
  4401 		$status['errorMessage'] = __( 'Sorry, you are not allowed to manage plugins for this site.' );
  3992 		wp_send_json_error( $status );
  4402 		wp_send_json_error( $status );
  3993 	}
  4403 	}
  3994 
  4404 
  3995 	// Set the correct requester, so pagination works.
  4405 	// Set the correct requester, so pagination works.
  3996 	$_SERVER['REQUEST_URI'] = add_query_arg( array_diff_key( $_POST, array(
  4406 	$_SERVER['REQUEST_URI'] = add_query_arg(
  3997 		'_ajax_nonce' => null,
  4407 		array_diff_key(
  3998 		'action'      => null,
  4408 			$_POST,
  3999 	) ), network_admin_url( 'plugin-install.php', 'relative' ) );
  4409 			array(
       
  4410 				'_ajax_nonce' => null,
       
  4411 				'action'      => null,
       
  4412 			)
       
  4413 		),
       
  4414 		network_admin_url( 'plugin-install.php', 'relative' )
       
  4415 	);
  4000 
  4416 
  4001 	$wp_list_table->prepare_items();
  4417 	$wp_list_table->prepare_items();
  4002 
  4418 
  4003 	ob_start();
  4419 	ob_start();
  4004 	$wp_list_table->display();
  4420 	$wp_list_table->display();
  4015  * @see wp_edit_theme_plugin_file()
  4431  * @see wp_edit_theme_plugin_file()
  4016  */
  4432  */
  4017 function wp_ajax_edit_theme_plugin_file() {
  4433 function wp_ajax_edit_theme_plugin_file() {
  4018 	$r = wp_edit_theme_plugin_file( wp_unslash( $_POST ) ); // Validation of args is done in wp_edit_theme_plugin_file().
  4434 	$r = wp_edit_theme_plugin_file( wp_unslash( $_POST ) ); // Validation of args is done in wp_edit_theme_plugin_file().
  4019 	if ( is_wp_error( $r ) ) {
  4435 	if ( is_wp_error( $r ) ) {
  4020 		wp_send_json_error( array_merge(
  4436 		wp_send_json_error(
       
  4437 			array_merge(
       
  4438 				array(
       
  4439 					'code'    => $r->get_error_code(),
       
  4440 					'message' => $r->get_error_message(),
       
  4441 				),
       
  4442 				(array) $r->get_error_data()
       
  4443 			)
       
  4444 		);
       
  4445 	} else {
       
  4446 		wp_send_json_success(
  4021 			array(
  4447 			array(
  4022 				'code' => $r->get_error_code(),
  4448 				'message' => __( 'File edited successfully.' ),
  4023 				'message' => $r->get_error_message(),
  4449 			)
  4024 			),
  4450 		);
  4025 			(array) $r->get_error_data()
       
  4026 		) );
       
  4027 	} else {
       
  4028 		wp_send_json_success( array(
       
  4029 			'message' => __( 'File edited successfully.' ),
       
  4030 		) );
       
  4031 	}
  4451 	}
  4032 }
  4452 }
  4033 
  4453 
  4034 /**
  4454 /**
  4035  * Ajax handler for exporting a user's personal data.
  4455  * Ajax handler for exporting a user's personal data.
  4046 	if ( $request_id < 1 ) {
  4466 	if ( $request_id < 1 ) {
  4047 		wp_send_json_error( __( 'Invalid request ID.' ) );
  4467 		wp_send_json_error( __( 'Invalid request ID.' ) );
  4048 	}
  4468 	}
  4049 
  4469 
  4050 	if ( ! current_user_can( 'export_others_personal_data' ) ) {
  4470 	if ( ! current_user_can( 'export_others_personal_data' ) ) {
  4051 		wp_send_json_error( __( 'Invalid request.' ) );
  4471 		wp_send_json_error( __( 'Sorry, you are not allowed to perform this action.' ) );
  4052 	}
  4472 	}
  4053 
  4473 
  4054 	check_ajax_referer( 'wp-privacy-export-personal-data-' . $request_id, 'security' );
  4474 	check_ajax_referer( 'wp-privacy-export-personal-data-' . $request_id, 'security' );
  4055 
  4475 
  4056 	// Get the request data.
  4476 	// Get the request data.
  4107 		if ( $exporter_index < 1 ) {
  4527 		if ( $exporter_index < 1 ) {
  4108 			wp_send_json_error( __( 'Exporter index cannot be negative.' ) );
  4528 			wp_send_json_error( __( 'Exporter index cannot be negative.' ) );
  4109 		}
  4529 		}
  4110 
  4530 
  4111 		if ( $exporter_index > count( $exporters ) ) {
  4531 		if ( $exporter_index > count( $exporters ) ) {
  4112 			wp_send_json_error( __( 'Exporter index out of range.' ) );
  4532 			wp_send_json_error( __( 'Exporter index is out of range.' ) );
  4113 		}
  4533 		}
  4114 
  4534 
  4115 		if ( $page < 1 ) {
  4535 		if ( $page < 1 ) {
  4116 			wp_send_json_error( __( 'Page index cannot be less than one.' ) );
  4536 			wp_send_json_error( __( 'Page index cannot be less than one.' ) );
  4117 		}
  4537 		}
  4120 		$exporter_key  = $exporter_keys[ $exporter_index - 1 ];
  4540 		$exporter_key  = $exporter_keys[ $exporter_index - 1 ];
  4121 		$exporter      = $exporters[ $exporter_key ];
  4541 		$exporter      = $exporters[ $exporter_key ];
  4122 
  4542 
  4123 		if ( ! is_array( $exporter ) ) {
  4543 		if ( ! is_array( $exporter ) ) {
  4124 			wp_send_json_error(
  4544 			wp_send_json_error(
  4125 				/* translators: %s: array index */
  4545 				/* translators: %s: exporter array index */
  4126 				sprintf( __( 'Expected an array describing the exporter at index %s.' ), $exporter_key )
  4546 				sprintf( __( 'Expected an array describing the exporter at index %s.' ), $exporter_key )
  4127 			);
  4547 			);
  4128 		}
  4548 		}
  4129 		if ( ! array_key_exists( 'exporter_friendly_name', $exporter ) ) {
  4549 		if ( ! array_key_exists( 'exporter_friendly_name', $exporter ) ) {
  4130 			wp_send_json_error(
  4550 			wp_send_json_error(
  4131 				/* translators: %s: array index */
  4551 				/* translators: %s: exporter array index */
  4132 				sprintf( __( 'Exporter array at index %s does not include a friendly name.' ), $exporter_key )
  4552 				sprintf( __( 'Exporter array at index %s does not include a friendly name.' ), $exporter_key )
  4133 			);
  4553 			);
  4134 		}
  4554 		}
       
  4555 
       
  4556 		$exporter_friendly_name = $exporter['exporter_friendly_name'];
       
  4557 
  4135 		if ( ! array_key_exists( 'callback', $exporter ) ) {
  4558 		if ( ! array_key_exists( 'callback', $exporter ) ) {
  4136 			wp_send_json_error(
  4559 			wp_send_json_error(
  4137 				/* translators: %s: exporter friendly name */
  4560 				/* translators: %s: exporter friendly name */
  4138 				sprintf( __( 'Exporter does not include a callback: %s.' ), esc_html( $exporter['exporter_friendly_name'] ) )
  4561 				sprintf( __( 'Exporter does not include a callback: %s.' ), esc_html( $exporter_friendly_name ) )
  4139 			);
  4562 			);
  4140 		}
  4563 		}
  4141 		if ( ! is_callable( $exporter['callback'] ) ) {
  4564 		if ( ! is_callable( $exporter['callback'] ) ) {
  4142 			wp_send_json_error(
  4565 			wp_send_json_error(
  4143 				/* translators: %s: exporter friendly name */
  4566 				/* translators: %s: exporter friendly name */
  4144 				sprintf( __( 'Exporter callback is not a valid callback: %s.' ), esc_html( $exporter['exporter_friendly_name'] ) )
  4567 				sprintf( __( 'Exporter callback is not a valid callback: %s.' ), esc_html( $exporter_friendly_name ) )
  4145 			);
  4568 			);
  4146 		}
  4569 		}
  4147 
  4570 
  4148 		$callback               = $exporter['callback'];
  4571 		$callback = $exporter['callback'];
  4149 		$exporter_friendly_name = $exporter['exporter_friendly_name'];
       
  4150 
       
  4151 		$response = call_user_func( $callback, $email_address, $page );
  4572 		$response = call_user_func( $callback, $email_address, $page );
       
  4573 
  4152 		if ( is_wp_error( $response ) ) {
  4574 		if ( is_wp_error( $response ) ) {
  4153 			wp_send_json_error( $response );
  4575 			wp_send_json_error( $response );
  4154 		}
  4576 		}
  4155 
  4577 
  4156 		if ( ! is_array( $response ) ) {
  4578 		if ( ! is_array( $response ) ) {
  4228 		wp_send_json_error( __( 'Invalid request ID.' ) );
  4650 		wp_send_json_error( __( 'Invalid request ID.' ) );
  4229 	}
  4651 	}
  4230 
  4652 
  4231 	// Both capabilities are required to avoid confusion, see `_wp_personal_data_removal_page()`.
  4653 	// Both capabilities are required to avoid confusion, see `_wp_personal_data_removal_page()`.
  4232 	if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
  4654 	if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
  4233 		wp_send_json_error( __( 'Invalid request.' ) );
  4655 		wp_send_json_error( __( 'Sorry, you are not allowed to perform this action.' ) );
  4234 	}
  4656 	}
  4235 
  4657 
  4236 	check_ajax_referer( 'wp-privacy-erase-personal-data-' . $request_id, 'security' );
  4658 	check_ajax_referer( 'wp-privacy-erase-personal-data-' . $request_id, 'security' );
  4237 
  4659 
  4238 	// Get the request data.
  4660 	// Get the request data.
  4239 	$request = wp_get_user_request_data( $request_id );
  4661 	$request = wp_get_user_request_data( $request_id );
  4240 
  4662 
  4241 	if ( ! $request || 'remove_personal_data' !== $request->action_name ) {
  4663 	if ( ! $request || 'remove_personal_data' !== $request->action_name ) {
  4242 		wp_send_json_error( __( 'Invalid request ID.' ) );
  4664 		wp_send_json_error( __( 'Invalid request type.' ) );
  4243 	}
  4665 	}
  4244 
  4666 
  4245 	$email_address = $request->email;
  4667 	$email_address = $request->email;
  4246 
  4668 
  4247 	if ( ! is_email( $email_address ) ) {
  4669 	if ( ! is_email( $email_address ) ) {
  4300 		$eraser_keys = array_keys( $erasers );
  4722 		$eraser_keys = array_keys( $erasers );
  4301 		$eraser_key  = $eraser_keys[ $eraser_index - 1 ];
  4723 		$eraser_key  = $eraser_keys[ $eraser_index - 1 ];
  4302 		$eraser      = $erasers[ $eraser_key ];
  4724 		$eraser      = $erasers[ $eraser_key ];
  4303 
  4725 
  4304 		if ( ! is_array( $eraser ) ) {
  4726 		if ( ! is_array( $eraser ) ) {
  4305 			/* translators: %d: array index */
  4727 			/* translators: %d: eraser array index */
  4306 			wp_send_json_error( sprintf( __( 'Expected an array describing the eraser at index %d.' ), $eraser_index ) );
  4728 			wp_send_json_error( sprintf( __( 'Expected an array describing the eraser at index %d.' ), $eraser_index ) );
  4307 		}
  4729 		}
  4308 
  4730 
       
  4731 		if ( ! array_key_exists( 'eraser_friendly_name', $eraser ) ) {
       
  4732 			/* translators: %d: eraser array index */
       
  4733 			wp_send_json_error( sprintf( __( 'Eraser array at index %d does not include a friendly name.' ), $eraser_index ) );
       
  4734 		}
       
  4735 
       
  4736 		$eraser_friendly_name = $eraser['eraser_friendly_name'];
       
  4737 
  4309 		if ( ! array_key_exists( 'callback', $eraser ) ) {
  4738 		if ( ! array_key_exists( 'callback', $eraser ) ) {
  4310 			/* translators: %d: array index */
  4739 			wp_send_json_error(
  4311 			wp_send_json_error( sprintf( __( 'Eraser array at index %d does not include a callback.' ), $eraser_index ) );
  4740 				sprintf(
       
  4741 					/* translators: %s: eraser friendly name */
       
  4742 					__( 'Eraser does not include a callback: %s.' ),
       
  4743 					esc_html( $eraser_friendly_name )
       
  4744 				)
       
  4745 			);
  4312 		}
  4746 		}
  4313 
  4747 
  4314 		if ( ! is_callable( $eraser['callback'] ) ) {
  4748 		if ( ! is_callable( $eraser['callback'] ) ) {
  4315 			/* translators: %d: array index */
  4749 			wp_send_json_error(
  4316 			wp_send_json_error( sprintf( __( 'Eraser callback at index %d is not a valid callback.' ), $eraser_index ) );
  4750 				sprintf(
  4317 		}
  4751 					/* translators: %s: eraser friendly name */
  4318 
  4752 					__( 'Eraser callback is not valid: %s.' ),
  4319 		if ( ! array_key_exists( 'eraser_friendly_name', $eraser ) ) {
  4753 					esc_html( $eraser_friendly_name )
  4320 			/* translators: %d: array index */
  4754 				)
  4321 			wp_send_json_error( sprintf( __( 'Eraser array at index %d does not include a friendly name.' ), $eraser_index ) );
  4755 			);
  4322 		}
  4756 		}
  4323 
  4757 
  4324 		$callback             = $eraser['callback'];
  4758 		$callback = $eraser['callback'];
  4325 		$eraser_friendly_name = $eraser['eraser_friendly_name'];
       
  4326 
       
  4327 		$response = call_user_func( $callback, $email_address, $page );
  4759 		$response = call_user_func( $callback, $email_address, $page );
  4328 
  4760 
  4329 		if ( is_wp_error( $response ) ) {
  4761 		if ( is_wp_error( $response ) ) {
  4330 			wp_send_json_error( $response );
  4762 			wp_send_json_error( $response );
  4331 		}
  4763 		}
  4332 
  4764 
  4333 		if ( ! is_array( $response ) ) {
  4765 		if ( ! is_array( $response ) ) {
  4334 			wp_send_json_error(
  4766 			wp_send_json_error(
  4335 				sprintf(
  4767 				sprintf(
  4336 					/* translators: 1: eraser friendly name, 2: array index */
  4768 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4337 					__( 'Did not receive array from %1$s eraser (index %2$d).' ),
  4769 					__( 'Did not receive array from %1$s eraser (index %2$d).' ),
  4338 					esc_html( $eraser_friendly_name ),
  4770 					esc_html( $eraser_friendly_name ),
  4339 					$eraser_index
  4771 					$eraser_index
  4340 				)
  4772 				)
  4341 			);
  4773 			);
  4342 		}
  4774 		}
  4343 
  4775 
  4344 		if ( ! array_key_exists( 'items_removed', $response ) ) {
  4776 		if ( ! array_key_exists( 'items_removed', $response ) ) {
  4345 			wp_send_json_error(
  4777 			wp_send_json_error(
  4346 				sprintf(
  4778 				sprintf(
  4347 					/* translators: 1: eraser friendly name, 2: array index */
  4779 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4348 					__( 'Expected items_removed key in response array from %1$s eraser (index %2$d).' ),
  4780 					__( 'Expected items_removed key in response array from %1$s eraser (index %2$d).' ),
  4349 					esc_html( $eraser_friendly_name ),
  4781 					esc_html( $eraser_friendly_name ),
  4350 					$eraser_index
  4782 					$eraser_index
  4351 				)
  4783 				)
  4352 			);
  4784 			);
  4353 		}
  4785 		}
  4354 
  4786 
  4355 		if ( ! array_key_exists( 'items_retained', $response ) ) {
  4787 		if ( ! array_key_exists( 'items_retained', $response ) ) {
  4356 			wp_send_json_error(
  4788 			wp_send_json_error(
  4357 				sprintf(
  4789 				sprintf(
  4358 					/* translators: 1: eraser friendly name, 2: array index */
  4790 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4359 					__( 'Expected items_retained key in response array from %1$s eraser (index %2$d).' ),
  4791 					__( 'Expected items_retained key in response array from %1$s eraser (index %2$d).' ),
  4360 					esc_html( $eraser_friendly_name ),
  4792 					esc_html( $eraser_friendly_name ),
  4361 					$eraser_index
  4793 					$eraser_index
  4362 				)
  4794 				)
  4363 			);
  4795 			);
  4364 		}
  4796 		}
  4365 
  4797 
  4366 		if ( ! array_key_exists( 'messages', $response ) ) {
  4798 		if ( ! array_key_exists( 'messages', $response ) ) {
  4367 			wp_send_json_error(
  4799 			wp_send_json_error(
  4368 				sprintf(
  4800 				sprintf(
  4369 					/* translators: 1: eraser friendly name, 2: array index */
  4801 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4370 					__( 'Expected messages key in response array from %1$s eraser (index %2$d).' ),
  4802 					__( 'Expected messages key in response array from %1$s eraser (index %2$d).' ),
  4371 					esc_html( $eraser_friendly_name ),
  4803 					esc_html( $eraser_friendly_name ),
  4372 					$eraser_index
  4804 					$eraser_index
  4373 				)
  4805 				)
  4374 			);
  4806 			);
  4375 		}
  4807 		}
  4376 
  4808 
  4377 		if ( ! is_array( $response['messages'] ) ) {
  4809 		if ( ! is_array( $response['messages'] ) ) {
  4378 			wp_send_json_error(
  4810 			wp_send_json_error(
  4379 				sprintf(
  4811 				sprintf(
  4380 					/* translators: 1: eraser friendly name, 2: array index */
  4812 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4381 					__( 'Expected messages key to reference an array in response array from %1$s eraser (index %2$d).' ),
  4813 					__( 'Expected messages key to reference an array in response array from %1$s eraser (index %2$d).' ),
  4382 					esc_html( $eraser_friendly_name ),
  4814 					esc_html( $eraser_friendly_name ),
  4383 					$eraser_index
  4815 					$eraser_index
  4384 				)
  4816 				)
  4385 			);
  4817 			);
  4386 		}
  4818 		}
  4387 
  4819 
  4388 		if ( ! array_key_exists( 'done', $response ) ) {
  4820 		if ( ! array_key_exists( 'done', $response ) ) {
  4389 			wp_send_json_error(
  4821 			wp_send_json_error(
  4390 				sprintf(
  4822 				sprintf(
  4391 					/* translators: 1: eraser friendly name, 2: array index */
  4823 					/* translators: 1: eraser friendly name, 2: eraser array index */
  4392 					__( 'Expected done flag in response array from %1$s eraser (index %2$d).' ),
  4824 					__( 'Expected done flag in response array from %1$s eraser (index %2$d).' ),
  4393 					esc_html( $eraser_friendly_name ),
  4825 					esc_html( $eraser_friendly_name ),
  4394 					$eraser_index
  4826 					$eraser_index
  4395 				)
  4827 				)
  4396 			);
  4828 			);
  4427 		wp_send_json_error( $response );
  4859 		wp_send_json_error( $response );
  4428 	}
  4860 	}
  4429 
  4861 
  4430 	wp_send_json_success( $response );
  4862 	wp_send_json_success( $response );
  4431 }
  4863 }
       
  4864 
       
  4865 /**
       
  4866  * Ajax handler for site health checks on server communication.
       
  4867  *
       
  4868  * @since 5.2.0
       
  4869  */
       
  4870 function wp_ajax_health_check_dotorg_communication() {
       
  4871 	check_ajax_referer( 'health-check-site-status' );
       
  4872 
       
  4873 	if ( ! current_user_can( 'view_site_health_checks' ) ) {
       
  4874 		wp_send_json_error();
       
  4875 	}
       
  4876 
       
  4877 	if ( ! class_exists( 'WP_Site_Health' ) ) {
       
  4878 		require_once( ABSPATH . 'wp-admin/includes/class-wp-site-health.php' );
       
  4879 	}
       
  4880 
       
  4881 	$site_health = new WP_Site_Health();
       
  4882 	wp_send_json_success( $site_health->get_test_dotorg_communication() );
       
  4883 }
       
  4884 
       
  4885 /**
       
  4886  * Ajax handler for site health checks on debug mode.
       
  4887  *
       
  4888  * @since 5.2.0
       
  4889  */
       
  4890 function wp_ajax_health_check_is_in_debug_mode() {
       
  4891 	wp_verify_nonce( 'health-check-site-status' );
       
  4892 
       
  4893 	if ( ! current_user_can( 'view_site_health_checks' ) ) {
       
  4894 		wp_send_json_error();
       
  4895 	}
       
  4896 
       
  4897 	if ( ! class_exists( 'WP_Site_Health' ) ) {
       
  4898 		require_once( ABSPATH . 'wp-admin/includes/class-wp-site-health.php' );
       
  4899 	}
       
  4900 
       
  4901 	$site_health = new WP_Site_Health();
       
  4902 	wp_send_json_success( $site_health->get_test_is_in_debug_mode() );
       
  4903 }
       
  4904 
       
  4905 /**
       
  4906  * Ajax handler for site health checks on background updates.
       
  4907  *
       
  4908  * @since 5.2.0
       
  4909  */
       
  4910 function wp_ajax_health_check_background_updates() {
       
  4911 	check_ajax_referer( 'health-check-site-status' );
       
  4912 
       
  4913 	if ( ! current_user_can( 'view_site_health_checks' ) ) {
       
  4914 		wp_send_json_error();
       
  4915 	}
       
  4916 
       
  4917 	if ( ! class_exists( 'WP_Site_Health' ) ) {
       
  4918 		require_once( ABSPATH . 'wp-admin/includes/class-wp-site-health.php' );
       
  4919 	}
       
  4920 
       
  4921 	$site_health = new WP_Site_Health();
       
  4922 	wp_send_json_success( $site_health->get_test_background_updates() );
       
  4923 }
       
  4924 
       
  4925 
       
  4926 /**
       
  4927  * Ajax handler for site health checks on loopback requests.
       
  4928  *
       
  4929  * @since 5.2.0
       
  4930  */
       
  4931 function wp_ajax_health_check_loopback_requests() {
       
  4932 	check_ajax_referer( 'health-check-site-status' );
       
  4933 
       
  4934 	if ( ! current_user_can( 'view_site_health_checks' ) ) {
       
  4935 		wp_send_json_error();
       
  4936 	}
       
  4937 
       
  4938 	if ( ! class_exists( 'WP_Site_Health' ) ) {
       
  4939 		require_once( ABSPATH . 'wp-admin/includes/class-wp-site-health.php' );
       
  4940 	}
       
  4941 
       
  4942 	$site_health = new WP_Site_Health();
       
  4943 	wp_send_json_success( $site_health->get_test_loopback_requests() );
       
  4944 }
       
  4945 
       
  4946 /**
       
  4947  * Ajax handler for site health check to update the result status.
       
  4948  *
       
  4949  * @since 5.2.0
       
  4950  */
       
  4951 function wp_ajax_health_check_site_status_result() {
       
  4952 	check_ajax_referer( 'health-check-site-status-result' );
       
  4953 
       
  4954 	if ( ! current_user_can( 'view_site_health_checks' ) ) {
       
  4955 		wp_send_json_error();
       
  4956 	}
       
  4957 
       
  4958 	set_transient( 'health-check-site-status-result', wp_json_encode( $_POST['counts'] ) );
       
  4959 
       
  4960 	wp_send_json_success();
       
  4961 }
       
  4962 
       
  4963 /**
       
  4964  * Ajax handler for site health check to get directories and database sizes.
       
  4965  *
       
  4966  * @since 5.2.0
       
  4967  */
       
  4968 function wp_ajax_health_check_get_sizes() {
       
  4969 	check_ajax_referer( 'health-check-site-status-result' );
       
  4970 
       
  4971 	if ( ! current_user_can( 'view_site_health_checks' ) || is_multisite() ) {
       
  4972 		wp_send_json_error();
       
  4973 	}
       
  4974 
       
  4975 	if ( ! class_exists( 'WP_Debug_Data' ) ) {
       
  4976 		require_once( ABSPATH . 'wp-admin/includes/class-wp-debug-data.php' );
       
  4977 	}
       
  4978 
       
  4979 	$sizes_data = WP_Debug_Data::get_sizes();
       
  4980 	$all_sizes  = array( 'raw' => 0 );
       
  4981 
       
  4982 	foreach ( $sizes_data as $name => $value ) {
       
  4983 		$name = sanitize_text_field( $name );
       
  4984 		$data = array();
       
  4985 
       
  4986 		if ( isset( $value['size'] ) ) {
       
  4987 			if ( is_string( $value['size'] ) ) {
       
  4988 				$data['size'] = sanitize_text_field( $value['size'] );
       
  4989 			} else {
       
  4990 				$data['size'] = (int) $value['size'];
       
  4991 			}
       
  4992 		}
       
  4993 
       
  4994 		if ( isset( $value['debug'] ) ) {
       
  4995 			if ( is_string( $value['debug'] ) ) {
       
  4996 				$data['debug'] = sanitize_text_field( $value['debug'] );
       
  4997 			} else {
       
  4998 				$data['debug'] = (int) $value['debug'];
       
  4999 			}
       
  5000 		}
       
  5001 
       
  5002 		if ( ! empty( $value['raw'] ) ) {
       
  5003 			$data['raw'] = (int) $value['raw'];
       
  5004 		}
       
  5005 
       
  5006 		$all_sizes[ $name ] = $data;
       
  5007 	}
       
  5008 
       
  5009 	if ( isset( $all_sizes['total_size']['debug'] ) && 'not available' === $all_sizes['total_size']['debug'] ) {
       
  5010 		wp_send_json_error( $all_sizes );
       
  5011 	}
       
  5012 
       
  5013 	wp_send_json_success( $all_sizes );
       
  5014 }