WP_Customize_Manager::setup_theme()

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Performance profile

How much work a call to WP_Customize_Manager::setup_theme() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Moderate

Reads stored settings via get_option(), cached per request but not free on a cold cache.

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

55–136

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 186.

Plugin surface

None

Nothing here hands control to plugin code.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• optionoption read or writeget_option()called directly
• hookthird-party callbacksapply_filters()one call below WP_Customize_Manager::setup_theme()
• cacheobject cachewp_cache_get()one call below WP_Customize_Manager::setup_theme()
• serializeserialisationmaybe_unserialize()one call below WP_Customize_Manager::setup_theme()

Further down the call graph this can also reach query and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 324 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_Customize_Manager::setup_theme() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Uses · 17

• current_user_can()Returns whether the current user has the specified capability.
• is_user_logged_in()Determines whether the current visitor is a logged in user.
• auth_redirect()Checks if a user is logged in, if not it redirects them to the login page.
• wp_die()Kills WordPress execution and displays HTML page with an error message.
• __()Retrieves the translation of $text.
• wp_is_uuid()Validates that a UUID is valid.
• check_ajax_referer()Verifies the Ajax request to prevent processing requests external of the blog.
• send_origin_headers()Sends Access-Control-Allow-Origin and related headers if the current request is from an allowed origin.
• show_admin_bar()Sets the display status of the admin bar.
• add_action()Adds a callback function to an action hook.
• get_option()Retrieves an option value based on an option name.
• WP_Customize_Manager::wp_die()Custom wp_die wrapper. Returns either the standard message for UI or the Ajax message.

Source code

View on Trac ↗View on GitHub ↗

515	public function setup_theme() {516		global $pagenow;517 518		// Check permissions for customize.php access since this method is called before customize.php can run any code.519		if ( 'customize.php' === $pagenow && ! current_user_can( 'customize' ) ) {520			if ( ! is_user_logged_in() ) {521				auth_redirect();522			} else {523				wp_die(524					'<h1>' . __( 'You need a higher level of permission.' ) . '</h1>' .525					'<p>' . __( 'Sorry, you are not allowed to customize this site.' ) . '</p>',526					403527				);528			}529			return;530		}531 532		// If a changeset was provided is invalid.533		if ( isset( $this->_changeset_uuid ) && false !== $this->_changeset_uuid && ! wp_is_uuid( $this->_changeset_uuid ) ) {534			$this->wp_die( -1, __( 'Invalid changeset UUID' ) );535		}536 537		/*538		 * Clear incoming post data if the user lacks a CSRF token (nonce). Note that the customizer539		 * application will inject the customize_preview_nonce query parameter into all Ajax requests.540		 * For similar behavior elsewhere in WordPress, see rest_cookie_check_errors() which logs out541		 * a user when a valid nonce isn't present.542		 */543		$has_post_data_nonce = (544			check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce', false )545			||546			check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce', false )547			||548			check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'customize_preview_nonce', false )549		);550		if ( ! current_user_can( 'customize' ) || ! $has_post_data_nonce ) {551			unset( $_POST['customized'] );552			unset( $_REQUEST['customized'] );553		}554 555		/*556		 * If unauthenticated then require a valid changeset UUID to load the preview.557		 * In this way, the UUID serves as a secret key. If the messenger channel is present,558		 * then send unauthenticated code to prompt re-auth.559		 */560		if ( ! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) {561			$this->wp_die( $this->messenger_channel ? 0 : -1, __( 'Non-existent changeset UUID.' ) );562		}563 564		if ( ! headers_sent() ) {565			send_origin_headers();566		}567 568		// Hide the admin bar if we're embedded in the customizer iframe.569		if ( $this->messenger_channel ) {570			show_admin_bar( false );571		}572 573		if ( $this->is_theme_active() ) {574			// Once the theme is loaded, we'll validate it.575			add_action( 'after_setup_theme', array( $this, 'after_setup_theme' ) );576		} else {577			/*578			 * If the requested theme is not the active theme and the user doesn't have579			 * the switch_themes cap, bail.580			 */581			if ( ! current_user_can( 'switch_themes' ) ) {582				$this->wp_die( -1, __( 'Sorry, you are not allowed to edit theme options on this site.' ) );583			}584 585			// If the theme has errors while loading, bail.586			if ( $this->theme()->errors() ) {587				$this->wp_die( -1, $this->theme()->errors()->get_error_message() );588			}589 590			// If the theme isn't allowed per multisite settings, bail.591			if ( ! $this->theme()->is_allowed() ) {592				$this->wp_die( -1, __( 'The requested theme does not exist.' ) );593			}594		}

Changelog

Introduced in 3.4.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/class-wp-customize-manager.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.