Block Theme Previews: Add a nonce for activation, and ensure that we …

…always load the filters even outside of wp-admin

src/wp-admin/includes/admin-filters.php

@@ -168,10 +168,3 @@
 
 // Append '(Draft)' to draft page titles in the privacy page dropdown.
 add_filter( 'list_pages', '_wp_privacy_settings_filter_draft_page_titles', 10, 2 );
-
-// Attaches filters to enable theme previews in the Site Editor.
-if ( ! empty( $_GET['wp_theme_preview'] ) ) {
-	add_filter( 'stylesheet', 'wp_get_theme_preview_path' );
-	add_filter( 'template', 'wp_get_theme_preview_path' );
-	add_action( 'init', 'wp_attach_theme_preview_middleware' );
-}

src/wp-admin/includes/admin.php

@@ -71,7 +71,6 @@
 
 /** WordPress Theme Administration API */
 require_once ABSPATH . 'wp-admin/includes/theme.php';
-require_once ABSPATH . 'wp-admin/includes/theme-previews.php';
 
 /** WordPress Privacy Functions */
 require_once ABSPATH . 'wp-admin/includes/privacy-tools.php';

src/wp-admin/includes/theme-previews.php → src/wp-includes/theme-previews.php

@@ -54,3 +54,28 @@ function wp_attach_theme_preview_middleware() {
 		'after'
 	);
 }
+
+
+// Attaches filters to enable theme previews in the Site Editor.
+if ( ! empty( $_GET['wp_theme_preview'] ) ) {
+	add_filter( 'stylesheet', 'wp_get_theme_preview_path' );
+	add_filter( 'template', 'wp_get_theme_preview_path' );
+	add_action( 'init', 'wp_attach_theme_preview_middleware' );
+	add_action( 'admin_head', 'block_theme_activate_nonce' );
+}
+
+
+
+/**
+ * Adds a nonce for the theme activation link.
+ */
+function block_theme_activate_nonce() {
+	$nonce_handle = 'switch-theme_' . wp_get_theme_preview_path();
+	?>
+<script type="text/javascript">
+	window.BLOCK_THEME_ACTIVATE_NONCE = '<?php echo wp_create_nonce( $nonce_handle ); ?>';
+</script>
+	<?php
+}
+
+

src/wp-settings.php

@@ -181,6 +181,7 @@
 require ABSPATH . WPINC . '/block-template-utils.php';
 require ABSPATH . WPINC . '/block-template.php';
 require ABSPATH . WPINC . '/theme-templates.php';
+require ABSPATH . WPINC . '/theme-previews.php';
 require ABSPATH . WPINC . '/template.php';
 require ABSPATH . WPINC . '/https-detection.php';
 require ABSPATH . WPINC . '/https-migration.php';