From aa2db425d8ee9e8f415eda54cf72e26ae264b18e Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@xwp.co>
Date: Tue, 23 Feb 2016 18:14:26 +0000
Subject: [PATCH] Customize: Skip exporting partials to client and handling
 rendering requests if user can't modify associated settings.

Introduces `WP_Customize_Partial::check_capabilities()` for parity with `WP_Customize_Control::check_capabilities()`.

See #27355.
Fixes #35914.

Built from https://develop.svn.wordpress.org/trunk@36643


git-svn-id: http://core.svn.wordpress.org/trunk@36610 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../customize/class-wp-customize-partial.php  | 26 +++++++++++++++++--
 .../class-wp-customize-selective-refresh.php  |  6 +++--
 wp-includes/version.php                       |  2 +-
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/wp-includes/customize/class-wp-customize-partial.php b/wp-includes/customize/class-wp-customize-partial.php
index f6e5e44565..3cb410b078 100644
--- a/wp-includes/customize/class-wp-customize-partial.php
+++ b/wp-includes/customize/class-wp-customize-partial.php
@@ -70,11 +70,11 @@ class WP_Customize_Partial {
 	public $selector;
 
 	/**
-	 * All settings tied to the partial.
+	 * IDs for settings tied to the partial.
 	 *
 	 * @access public
 	 * @since 4.5.0
-	 * @var WP_Customize_Setting[]
+	 * @var array
 	 */
 	public $settings;
 
@@ -285,4 +285,26 @@ class WP_Customize_Partial {
 		);
 		return $exports;
 	}
+
+	/**
+	 * Checks if the user can refresh this partial.
+	 *
+	 * Returns false if the user cannot manipulate one of the associated settings,
+	 * or if one of the associated settings does not exist.
+	 *
+	 * @since 4.5.0
+	 * @access public
+	 *
+	 * @return bool False if user can't edit one one of the related settings,
+	 *                    or if one of the associated settings does not exist.
+	 */
+	final public function check_capabilities() {
+		foreach ( $this->settings as $setting_id ) {
+			$setting = $this->component->manager->get_setting( $setting_id );
+			if ( ! $setting || ! $setting->check_capabilities() ) {
+				return false;
+			}
+		}
+		return true;
+	}
 }
diff --git a/wp-includes/customize/class-wp-customize-selective-refresh.php b/wp-includes/customize/class-wp-customize-selective-refresh.php
index bf8a9e3c8e..23bf06d7f4 100644
--- a/wp-includes/customize/class-wp-customize-selective-refresh.php
+++ b/wp-includes/customize/class-wp-customize-selective-refresh.php
@@ -172,7 +172,9 @@ final class WP_Customize_Selective_Refresh {
 		$partials = array();
 
 		foreach ( $this->partials() as $partial ) {
-			$partials[ $partial->id ] = $partial->json();
+			if ( $partial->check_capabilities() ) {
+				$partials[ $partial->id ] = $partial->json();
+			}
 		}
 
 		$exports = array(
@@ -356,7 +358,7 @@ final class WP_Customize_Selective_Refresh {
 
 			$partial = $this->get_partial( $partial_id );
 
-			if ( ! $partial ) {
+			if ( ! $partial || ! $partial->check_capabilities() ) {
 				$contents[ $partial_id ] = null;
 				continue;
 			}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0862c074f3..b270657ea9 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.5-alpha-36642';
+$wp_version = '4.5-alpha-36643';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.