WP_Customize_Manager::save()

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Performance profile

How much work a call to WP_Customize_Manager::save() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

105–165

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 341.

Plugin surface

1 hook

Third-party callbacks on 'customize_save_response' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• querycontent queryget_post()called directly
• hookthird-party callbacksapply_filters()called directly

Further down the call graph this can also reach option, cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 100 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_Customize_Manager::save() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 1

One hook fires while WP_Customize_Manager::save() runs, in this order:

1. 1
   apply_filters( customize_save_response )filterline 2612 (+181 into the body)

   Filters response data for a successful customize_save Ajax request.

Uses · 25

• is_user_logged_in()Determines whether the current visitor is a logged in user.
• wp_send_json_error()Sends a JSON response back to an Ajax request, indicating failure.
• check_ajax_referer()Verifies the Ajax request to prevent processing requests external of the blog.
• current_user_can()Returns whether the current user has the specified capability.
• get_post_type_object()Retrieves a post type object by name.
• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• sanitize_text_field()Sanitizes a string from user input or from the database.
• get_post_status_object()Retrieves a post status object by name.
• wp_checkdate()Tests if the supplied date is valid for the Gregorian calendar.
• get_gmt_from_date()Given a date in the timezone of the site, returns that date in UTC.
• wp_check_post_lock()Determines whether the post is currently being edited by another user.
• is_wp_error()Checks whether the given variable is a WordPress Error.

Source code

View on Trac ↗View on GitHub ↗

2431	public function save() {2432		if ( ! is_user_logged_in() ) {2433			wp_send_json_error( 'unauthenticated' );2434		}2435 2436		if ( ! $this->is_preview() ) {2437			wp_send_json_error( 'not_preview' );2438		}2439 2440		$action = 'save-customize_' . $this->get_stylesheet();2441		if ( ! check_ajax_referer( $action, 'nonce', false ) ) {2442			wp_send_json_error( 'invalid_nonce' );2443		}2444 2445		$changeset_post_id = $this->changeset_post_id();2446		$is_new_changeset  = empty( $changeset_post_id );2447		if ( $is_new_changeset ) {2448			if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->create_posts ) ) {2449				wp_send_json_error( 'cannot_create_changeset_post' );2450			}2451		} else {2452			if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) ) {2453				wp_send_json_error( 'cannot_edit_changeset_post' );2454			}2455		}2456 2457		if ( ! empty( $_POST['customize_changeset_data'] ) ) {2458			$input_changeset_data = json_decode( wp_unslash( $_POST['customize_changeset_data'] ), true );2459			if ( ! is_array( $input_changeset_data ) ) {2460				wp_send_json_error( 'invalid_customize_changeset_data' );2461			}2462		} else {2463			$input_changeset_data = array();2464		}2465 2466		// Validate title.2467		$changeset_title = null;2468		if ( isset( $_POST['customize_changeset_title'] ) ) {2469			$changeset_title = sanitize_text_field( wp_unslash( $_POST['customize_changeset_title'] ) );2470		}2471 2472		// Validate changeset status param.2473		$is_publish       = null;2474		$changeset_status = null;2475		if ( isset( $_POST['customize_changeset_status'] ) ) {2476			$changeset_status = wp_unslash( $_POST['customize_changeset_status'] );2477			if ( ! get_post_status_object( $changeset_status ) || ! in_array( $changeset_status, array( 'draft', 'pending', 'publish', 'future' ), true ) ) {2478				wp_send_json_error( 'bad_customize_changeset_status', 400 );2479			}2480			$is_publish = ( 'publish' === $changeset_status || 'future' === $changeset_status );2481			if ( $is_publish && ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->publish_posts ) ) {2482				wp_send_json_error( 'changeset_publish_unauthorized', 403 );2483			}2484		}2485 2486		/*2487		 * Validate changeset date param. Date is assumed to be in local time for2488		 * the WP if in MySQL format (YYYY-MM-DD HH:MM:SS). Otherwise, the date2489		 * is parsed with strtotime() so that ISO date format may be supplied2490		 * or a string like "+10 minutes".2491		 */2492		$changeset_date_gmt = null;2493		if ( isset( $_POST['customize_changeset_date'] ) ) {2494			$changeset_date = wp_unslash( $_POST['customize_changeset_date'] );2495			if ( preg_match( '/^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d$/', $changeset_date ) ) {2496				$mm         = substr( $changeset_date, 5, 2 );2497				$jj         = substr( $changeset_date, 8, 2 );2498				$aa         = substr( $changeset_date, 0, 4 );2499				$valid_date = wp_checkdate( $mm, $jj, $aa, $changeset_date );2500				if ( ! $valid_date ) {2501					wp_send_json_error( 'bad_customize_changeset_date', 400 );2502				}2503				$changeset_date_gmt = get_gmt_from_date( $changeset_date );2504			} else {2505				$timestamp = strtotime( $changeset_date );2506				if ( ! $timestamp ) {2507					wp_send_json_error( 'bad_customize_changeset_date', 400 );2508				}2509				$changeset_date_gmt = gmdate( 'Y-m-d H:i:s', $timestamp );2510			}

Changelog

Introduced in 3.4.0. One change between 6.7.7 and 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/class-wp-customize-manager.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.