X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/d3947bc013df7edd54b46deed8230d2eeafc5ecb..8d3bb1a5dcfdea9857d3c88c3751f09593e34dc8:/wp-includes/rest-api.php

diff --git a/wp-includes/rest-api.php b/wp-includes/rest-api.php
index 2375676c..13bfa596 100644
--- a/wp-includes/rest-api.php
+++ b/wp-includes/rest-api.php
@@ -159,7 +159,7 @@ function rest_api_loaded() {
  */
 function rest_get_url_prefix() {
 	/**
-	 * Filter the REST URL prefix.
+	 * Filters the REST URL prefix.
 	 *
 	 * @since 4.4.0
 	 *
@@ -206,9 +206,9 @@ function get_rest_url( $blog_id = null, $path = '/', $scheme = 'rest' ) {
 	}
 
 	/**
-	 * Filter the REST URL.
+	 * Filters the REST URL.
 	 *
-	 * Use this filter to adjust the url returned by the `get_rest_url` function.
+	 * Use this filter to adjust the url returned by the get_rest_url() function.
 	 *
 	 * @since 4.4.0
 	 *
@@ -269,7 +269,7 @@ function rest_get_server() {
 
 	if ( empty( $wp_rest_server ) ) {
 		/**
-		 * Filter the REST Server Class.
+		 * Filters the REST Server Class.
 		 *
 		 * This filter allows you to adjust the server class used by the API, using a
 		 * different class to handle requests.
@@ -548,10 +548,12 @@ function rest_output_link_header() {
  *
  * @since 4.4.0
  *
- * @global mixed $wp_rest_auth_cookie
+ * @global mixed          $wp_rest_auth_cookie
+ * @global WP_REST_Server $wp_rest_server      REST server instance.
  *
- * @param WP_Error|mixed $result Error from another authentication handler, null if we should handle it,
- *                               or another value if not.
+ * @param WP_Error|mixed $result Error from another authentication handler,
+ *                               null if we should handle it, or another value
+ *                               if not.
  * @return WP_Error|mixed|bool WP_Error if the cookie is invalid, the $result, otherwise true.
  */
 function rest_cookie_check_errors( $result ) {
@@ -559,7 +561,7 @@ function rest_cookie_check_errors( $result ) {
 		return $result;
 	}
 
-	global $wp_rest_auth_cookie;
+	global $wp_rest_auth_cookie, $wp_rest_server;
 
 	/*
 	 * Is cookie authentication being used? (If we get an auth
@@ -592,6 +594,9 @@ function rest_cookie_check_errors( $result ) {
 		return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Cookie nonce is invalid' ), array( 'status' => 403 ) );
 	}
 
+	// Send a refreshed nonce in header.
+	$wp_rest_server->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+
 	return true;
 }