at path：
ROOT
/
wp-content
/
plugins
/
jetpack
/
class.frame-nonce-preview.php
run：
R
W
Run
3rd-party
DIR
2026-04-17 06:07:54
R
W
Run
_inc
DIR
2026-04-17 06:07:56
R
W
Run
css
DIR
2026-04-17 06:07:54
R
W
Run
extensions
DIR
2026-04-17 06:07:53
R
W
Run
images
DIR
2026-04-17 06:07:55
R
W
Run
jetpack_vendor
DIR
2026-04-17 06:07:58
R
W
Run
json-endpoints
DIR
2026-04-17 06:07:59
R
W
Run
modules
DIR
2026-04-17 06:07:59
R
W
Run
sal
DIR
2026-04-17 06:07:59
R
W
Run
src
DIR
2026-04-17 06:07:59
R
W
Run
vendor
DIR
2026-04-17 06:07:59
R
W
Run
views
DIR
2026-04-17 06:07:54
R
W
Run
CHANGELOG.md
766.64 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
LICENSE.txt
18.2 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
SECURITY.md
2.45 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
class-jetpack-connection-status.php
728 By
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class-jetpack-gallery-settings.php
3.47 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class-jetpack-newsletter-dashboard-widget.php
436 By
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class-jetpack-pre-connection-jitms.php
2.34 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class-jetpack-stats-dashboard-widget.php
7.46 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class-jetpack-xmlrpc-methods.php
7.38 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.frame-nonce-preview.php
3.22 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-admin.php
21.09 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-autoupdate.php
9.93 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-cli.php
74.32 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-client-server.php
2.62 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-gutenberg.php
45.32 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-heartbeat.php
4.44 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-modules-list-table.php
14.81 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-network-sites-list-table.php
6.03 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-network.php
22.19 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-plan.php
4.09 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-post-images.php
11.72 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-twitter-cards.php
5.69 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack-user-agent.php
25.3 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.jetpack.php
204.86 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.json-api-endpoints.php
91.36 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.json-api.php
38.3 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
class.photon.php
1.74 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
composer.json
4.25 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
enhanced-open-graph.php
4.71 KB
2026-04-17 06:07:54
R
W
Run
Delete
Rename
functions.compat.php
4.34 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
functions.cookies.php
2.04 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
functions.global.php
13.91 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
functions.is-mobile.php
2.47 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
functions.opengraph.php
30.99 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
functions.photon.php
3.04 KB
2026-04-17 06:07:55
R
W
Run
Delete
Rename
jetpack.php
8.92 KB
2026-04-17 06:07:56
R
W
Run
Delete
Rename
json-api-config.php
338 By
2026-04-17 06:07:58
R
W
Run
Delete
Rename
json-endpoints.php
6.92 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
load-jetpack.php
3.69 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
locales.php
371 By
2026-04-17 06:07:59
R
W
Run
Delete
Rename
readme.txt
33.15 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
unauth-file-upload.php
5.85 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
uninstall.php
1.65 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
wpml-config.xml
1.26 KB
2026-04-17 06:07:59
R
W
Run
Delete
Rename
error_log
up
📄
class.frame-nonce-preview.php
Save
<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName /** * Allows viewing posts on the frontend when the user is not logged in. * * @package automattic/jetpack */ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- This is _implementing_ cross-site nonce handling, no need for WordPress's nonces. /** * Allows viewing posts on the frontend when the user is not logged in. */ class Jetpack_Frame_Nonce_Preview { /** * Static instance. * * @todo This should be private. * @var self */ public static $instance = null; /** * Returns the single instance of the Jetpack_Frame_Nonce_Preview object * * @since 4.3.0 * * @return Jetpack_Frame_Nonce_Preview **/ public static function get_instance() { if ( null === self::$instance ) { self::$instance = new Jetpack_Frame_Nonce_Preview(); } return self::$instance; } /** * Constructor. * * @todo This should be private. */ public function __construct() { if ( isset( $_GET['frame-nonce'] ) && ! is_admin() ) { add_filter( 'pre_get_posts', array( $this, 'maybe_display_post' ) ); } // autosave previews are validated differently. if ( isset( $_GET['frame-nonce'] ) && isset( $_GET['preview_id'] ) && isset( $_GET['preview_nonce'] ) ) { remove_action( 'init', '_show_post_preview' ); add_action( 'init', array( $this, 'handle_autosave_nonce_validation' ) ); } } /** * Verify that frame nonce exists, and if so, validate the nonce by calling WP.com. * * @since 4.3.0 * * @return bool */ public function is_frame_nonce_valid() { if ( empty( $_GET['frame-nonce'] ) ) { return false; } $xml = new Jetpack_IXR_Client(); $xml->query( 'jetpack.verifyFrameNonce', sanitize_key( $_GET['frame-nonce'] ) ); if ( $xml->isError() ) { return false; } return (bool) $xml->getResponse(); } /** * Conditionally add a hook on posts_results if this is the main query, a preview, and singular. * * @since 4.3.0 * * @param WP_Query $query Query. * @return WP_Query */ public function maybe_display_post( $query ) { if ( $query->is_main_query() && $query->is_preview() && $query->is_singular() ) { add_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10, 2 ); } return $query; } /** * Conditionally set the first post to 'publish' if the frame nonce is valid and there is a post. * * @since 4.3.0 * * @param array $posts Posts. * @return array */ public function set_post_to_publish( $posts ) { remove_filter( 'posts_results', array( $this, 'set_post_to_publish' ), 10 ); if ( empty( $posts ) || is_user_logged_in() || ! $this->is_frame_nonce_valid() ) { return $posts; } $posts[0]->post_status = 'publish'; // Disable comments and pings for this post. add_filter( 'comments_open', '__return_false' ); add_filter( 'pings_open', '__return_false' ); return $posts; } /** * Handle validation for autosave preview request * * @since 4.7.0 */ public function handle_autosave_nonce_validation() { if ( ! $this->is_frame_nonce_valid() ) { wp_die( esc_html__( 'Sorry, you are not allowed to preview drafts.', 'jetpack' ) ); } add_filter( 'the_preview', '_set_preview' ); } } Jetpack_Frame_Nonce_Preview::get_instance();