+
+/**
+ * Ajax handler for auto-saving the selected color scheme for
+ * a user's own profile.
+ *
+ * @since 3.8.0
+ */
+function wp_ajax_save_user_color_scheme() {
+ global $_wp_admin_css_colors;
+
+ check_ajax_referer( 'save-color-scheme', 'nonce' );
+
+ $color_scheme = sanitize_key( $_POST['color_scheme'] );
+
+ if ( ! isset( $_wp_admin_css_colors[ $color_scheme ] ) ) {
+ wp_send_json_error();
+ }
+
+ update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
+ wp_send_json_success();
+}
+
+/**
+ * Ajax handler for getting themes from themes_api().
+ *
+ * @since 3.9.0
+ */
+function wp_ajax_query_themes() {
+ global $themes_allowedtags, $theme_field_defaults;
+
+ if ( ! current_user_can( 'install_themes' ) ) {
+ wp_send_json_error();
+ }
+
+ $args = wp_parse_args( wp_unslash( $_REQUEST['request'] ), array(
+ 'per_page' => 20,
+ 'fields' => $theme_field_defaults
+ ) );
+
+ $old_filter = isset( $args['browse'] ) ? $args['browse'] : 'search';
+
+ /** This filter is documented in wp-admin/includes/class-wp-theme-install-list-table.php */
+ $args = apply_filters( 'install_themes_table_api_args_' . $old_filter, $args );
+
+ $api = themes_api( 'query_themes', $args );
+
+ if ( is_wp_error( $api ) ) {
+ wp_send_json_error();
+ }
+
+ $update_php = network_admin_url( 'update.php?action=install-theme' );
+ foreach ( $api->themes as &$theme ) {
+ $theme->install_url = add_query_arg( array(
+ 'theme' => $theme->slug,
+ '_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug )
+ ), $update_php );
+
+ $theme->name = wp_kses( $theme->name, $themes_allowedtags );
+ $theme->author = wp_kses( $theme->author, $themes_allowedtags );
+ $theme->version = wp_kses( $theme->version, $themes_allowedtags );
+ $theme->description = wp_kses( $theme->description, $themes_allowedtags );
+ $theme->num_ratings = sprintf( _n( '(based on %s rating)', '(based on %s ratings)', $theme->num_ratings ), number_format_i18n( $theme->num_ratings ) );
+ $theme->preview_url = set_url_scheme( $theme->preview_url );
+ }
+
+ wp_send_json_success( $api );
+}
+
+/**
+ * Apply [embed] AJAX handlers to a string.
+ *
+ * @since 4.0.0
+ *
+ * @global WP_Post $post Global $post.
+ * @global WP_Embed $wp_embed Embed API instance.
+ */
+function wp_ajax_parse_embed() {
+ global $post, $wp_embed;
+
+ if ( ! $post = get_post( (int) $_POST['post_ID'] ) ) {
+ wp_send_json_error();
+ }
+
+ if ( empty( $_POST['shortcode'] ) || ! current_user_can( 'edit_post', $post->ID ) ) {
+ wp_send_json_error();
+ }
+
+ $shortcode = wp_unslash( $_POST['shortcode'] );
+ $url = str_replace( '[embed]', '', str_replace( '[/embed]', '', $shortcode ) );
+ $parsed = false;
+ setup_postdata( $post );
+
+ $wp_embed->return_false_on_fail = true;
+
+ if ( is_ssl() && preg_match( '%^\\[embed[^\\]]*\\]http://%i', $shortcode ) ) {
+ // Admin is ssl and the user pasted non-ssl URL.
+ // Check if the provider supports ssl embeds and use that for the preview.
+ $ssl_shortcode = preg_replace( '%^(\\[embed[^\\]]*\\])http://%i', '$1https://', $shortcode );
+ $parsed = $wp_embed->run_shortcode( $ssl_shortcode );
+
+ if ( ! $parsed ) {
+ $no_ssl_support = true;
+ }
+ }
+
+ if ( ! $parsed ) {
+ $parsed = $wp_embed->run_shortcode( $shortcode );
+ }
+
+ if ( ! $parsed ) {
+ wp_send_json_error( array(
+ 'type' => 'not-embeddable',
+ 'message' => sprintf( __( '%s failed to embed.' ), '<code>' . esc_html( $url ) . '</code>' ),
+ ) );
+ }
+
+ if ( has_shortcode( $parsed, 'audio' ) || has_shortcode( $parsed, 'video' ) ) {
+ $styles = '';
+ $mce_styles = wpview_media_sandbox_styles();
+ foreach ( $mce_styles as $style ) {
+ $styles .= sprintf( '<link rel="stylesheet" href="%s"/>', $style );
+ }
+
+ $html = do_shortcode( $parsed );
+
+ global $wp_scripts;
+ if ( ! empty( $wp_scripts ) ) {
+ $wp_scripts->done = array();
+ }
+ ob_start();
+ wp_print_scripts( 'wp-mediaelement' );
+ $scripts = ob_get_clean();
+
+ $parsed = $styles . $html . $scripts;
+ }
+
+
+ if ( ! empty( $no_ssl_support ) || ( is_ssl() && ( preg_match( '%<(iframe|script|embed) [^>]*src="http://%', $parsed ) ||
+ preg_match( '%<link [^>]*href="http://%', $parsed ) ) ) ) {
+ // Admin is ssl and the embed is not. Iframes, scripts, and other "active content" will be blocked.
+ wp_send_json_error( array(
+ 'type' => 'not-ssl',
+ 'message' => __( 'This preview is unavailable in the editor.' ),
+ ) );
+ }
+
+ wp_send_json_success( array(
+ 'body' => $parsed
+ ) );
+}
+
+function wp_ajax_parse_media_shortcode() {
+ global $post, $wp_scripts;
+
+ if ( ! $post = get_post( (int) $_POST['post_ID'] ) ) {
+ wp_send_json_error();
+ }
+
+ if ( empty( $_POST['shortcode'] ) || ! current_user_can( 'edit_post', $post->ID ) ) {
+ wp_send_json_error();
+ }
+
+ setup_postdata( $post );
+ $shortcode = do_shortcode( wp_unslash( $_POST['shortcode'] ) );
+
+ if ( empty( $shortcode ) ) {
+ wp_send_json_error( array(
+ 'type' => 'no-items',
+ 'message' => __( 'No items found.' ),
+ ) );
+ }
+
+ $head = '';
+ $styles = wpview_media_sandbox_styles();
+
+ foreach ( $styles as $style ) {
+ $head .= '<link type="text/css" rel="stylesheet" href="' . $style . '">';
+ }
+
+ if ( ! empty( $wp_scripts ) ) {
+ $wp_scripts->done = array();
+ }
+
+ ob_start();
+
+ echo $shortcode;
+
+ if ( 'playlist' === $_REQUEST['type'] ) {
+ wp_underscore_playlist_templates();
+
+ wp_print_scripts( 'wp-playlist' );
+ } else {
+ wp_print_scripts( 'wp-mediaelement' );
+ }
+
+ wp_send_json_success( array(
+ 'head' => $head,
+ 'body' => ob_get_clean()
+ ) );
+}
+
+/**
+ * AJAX handler for destroying multiple open sessions for a user.
+ *
+ * @since 4.1.0
+ */
+function wp_ajax_destroy_sessions() {
+
+ $user = get_userdata( (int) $_POST['user_id'] );
+ if ( $user ) {
+ if ( ! current_user_can( 'edit_user', $user->ID ) ) {
+ $user = false;
+ } elseif ( ! wp_verify_nonce( $_POST['nonce'], 'update-user_' . $user->ID ) ) {
+ $user = false;
+ }
+ }
+
+ if ( ! $user ) {
+ wp_send_json_error( array(
+ 'message' => __( 'Could not log out user sessions. Please try again.' ),
+ ) );
+ }
+
+ $sessions = WP_Session_Tokens::get_instance( $user->ID );
+
+ if ( $user->ID === get_current_user_id() ) {
+ $sessions->destroy_others( wp_get_session_token() );
+ $message = __( 'You are now logged out everywhere else.' );
+ } else {
+ $sessions->destroy_all();
+ /* translators: 1: User's display name. */
+ $message = sprintf( __( '%s has been logged out.' ), $user->display_name );
+ }
+
+ wp_send_json_success( array( 'message' => $message ) );
+}