Ensure that preview urls are used as permalinks for customized posts

php/class-customize-posts-plugin.php

@@ -150,6 +150,10 @@ function load_support_classes( $wp_customize ) {
 
 		foreach ( array( 'theme', 'plugin' ) as $type ) {
 			foreach ( glob( dirname( __FILE__ ) . '/' . $type . '-support/class-*.php' ) as $file_path ) {
+				if ( 0 !== validate_file( $file_path ) ) {
+					continue;
+				}
+
 				require_once $file_path;
 
 				$class_name = str_replace( '-', '_', preg_replace( '/^class-(.+)\.php$/', '$1', basename( $file_path ) ) );

php/class-wp-customize-posts.php

@@ -405,20 +405,6 @@ public function register_post_type_meta_settings( $post ) {
 		return $setting_ids;
 	}
 
-	/**
-	 * When loading the customizer from a post, get the post.
-	 *
-	 * @return WP_Post|null
-	 */
-	public function get_previewed_post() {
-		$post_id = url_to_postid( $this->manager->get_preview_url() );
-		if ( 0 === $post_id ) {
-			return null;
-		}
-		$post = get_post( $post_id );
-		return $post;
-	}
-
 	/**
 	 * Get the post status choices array.
 	 *
@@ -861,7 +847,10 @@ public function transition_customize_draft( $data ) {
 	 * @access public
 	 */
 	public function preview_customize_draft_post_ids() {
-		if ( isset( $_REQUEST['preview'] ) ) { // @todo Why not look at $wp_query->is_preview()?
+
+		// Note that is_preview() cannot be used because this is called at after_setup_theme before WP_Query is initialized.
+		$is_preview = isset( $_GET['preview'] );
+		if ( $is_preview ) {
 			$this->customize_draft_post_ids = array();
 			foreach ( $this->manager->unsanitized_post_values() as $id => $post_data ) {
 				if ( ! preg_match( WP_Customize_Post_Setting::SETTING_ID_PATTERN, $id, $matches ) ) {
@@ -910,7 +899,8 @@ public function preview_customize_draft( $query ) {
 	 * @return string
 	 */
 	public function post_link_draft( $permalink, $post ) {
-		if ( is_customize_preview() && ! $this->suppress_post_link_filters ) {
+		$post_setting_id = WP_Customize_Post_Setting::get_post_setting_id( get_post( $post ) );
+		if ( ( is_customize_preview() && ! $this->suppress_post_link_filters ) || array_key_exists( $post_setting_id, $this->manager->unsanitized_post_values() ) ) {
 			$permalink = Edit_Post_Preview::get_preview_post_link( get_post( $post ) );
 		}
 		return $permalink;
@@ -1190,7 +1180,7 @@ public function ajax_posts_select2_query() {
 		$query_args['paged'] = max( 1, $query_args['paged'] );
 
 		if ( ! empty( $_POST['s'] ) ) {
-			$query_args['s'] = wp_unslash( $_POST['s'] );
+			$query_args['s'] = sanitize_text_field( wp_unslash( $_POST['s'] ) );
 		}
 
 		$query_args['post_status'] = get_post_stati( array( 'protected' => true ) );

tests/php/test-class-wp-customize-posts-preview.php

@@ -372,7 +372,9 @@ public function test_get_previewed_posts_for_query() {
 			'post_title' => 'Testing Page Draft',
 			'post_status' => 'publish',
 		);
-		$_POST['customized'] = wp_slash( wp_json_encode( $data ) );
+		foreach ( $data as $id => $value ) {
+			$this->posts_component->manager->set_post_value( $id, $value );
+		}
 
 		$query = new WP_Query( array( 'post_type' => 'post' ) );
 		$this->assertEquals( array( $post->ID ), $this->posts_component->preview->get_previewed_posts_for_query( $query ) );

tests/php/test-class-wp-customize-posts.php

@@ -75,7 +75,6 @@ function tearDown() {
 		unset( $_POST['customized'] );
 		unset( $GLOBALS['wp_customize'] );
 		unset( $GLOBALS['wp_scripts'] );
-		unset( $_REQUEST['preview'] );
 		unset( $_REQUEST['customize_snapshot_uuid'] );
 		parent::tearDown();
 	}
@@ -289,31 +288,6 @@ public function customize_register() {
 		$this->wp_customize->add_setting( $setting_id );
 	}
 
-	/**
-	 * Test that the previewed post is returned.
-	 *
-	 * @see WP_Customize_Posts::get_previewed_post()
-	 */
-	public function test_get_previewed_post() {
-		$this->wp_customize->set_preview_url( get_permalink( $this->post_id ) );
-		$posts = new WP_Customize_Posts( $this->wp_customize );
-		$this->do_customize_boot_actions();
-		$post = $posts->get_previewed_post();
-		$this->assertEquals( $this->post_id, $post->ID );
-	}
-
-	/**
-	 * Test that the previewed post is null.
-	 *
-	 * @see WP_Customize_Posts::get_previewed_post()
-	 */
-	public function test_get_previewed_post_is_null() {
-		$posts = new WP_Customize_Posts( $this->wp_customize );
-		$this->do_customize_boot_actions();
-		$post = $posts->get_previewed_post();
-		$this->assertNull( $post );
-	}
-
 	/**
 	 * Tests get_post_status_choices().
 	 *
@@ -544,11 +518,10 @@ public function test_preview_customize_draft_post_ids() {
 		$this->posts->preview_customize_draft_post_ids();
 		$this->assertEmpty( $this->posts->customize_draft_post_ids );
 
-		$_REQUEST['preview'] = 'true';
-		$this->posts->preview_customize_draft_post_ids();
-		$this->assertEmpty( $this->posts->customize_draft_post_ids );
-
 		$post_id = $this->factory()->post->create();
+		$this->go_to( home_url( sprintf( '/?preview=true&p=%d', $post_id ) ) );
+		$this->assertTrue( isset( $_GET['preview'] ) );
+
 		$setting_id = WP_Customize_Post_Setting::get_post_setting_id( get_post( $post_id ) );
 		$settings = $this->posts->manager->add_dynamic_settings( array( $setting_id ) );
 		$setting = array_shift( $settings );
@@ -614,13 +587,14 @@ public function test_preview_customize_draft( $post_type ) {
 		$GLOBALS['current_user'] = null;
 
 		$this->go_to( home_url( sprintf( '?%s=%d&preview=true', 'page' === $post_type ? 'page_id' : 'p', $post->ID ) ) );
-		$_REQUEST['preview'] = 'true';
+		$this->assertTrue( isset( $_GET['preview'] ) );
 		$this->posts->preview_customize_draft_post_ids();
 		$GLOBALS['wp_query']->query( $GLOBALS['wp']->query_vars );
 
 		$this->assertTrue( $GLOBALS['wp_query']->is_preview );
 		$this->assertEquals( 'true', $GLOBALS['wp_query']->query_vars['preview'] );
 		$this->assertEquals( $post->ID, $GLOBALS['wp_query']->query_vars['p'] );
+		$this->assertArrayHasKey( 'post_status', $GLOBALS['wp_query']->query_vars );
 		$this->assertEquals( 'customize-draft', $GLOBALS['wp_query']->query_vars['post_status'] );
 	}