Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings.

Introduces `WP_Customize_Partial::check_capabilities()` for parity with `WP_Customize_Control::check_capabilities()`.
 
See #27355.
Fixes #35914.

Built from https://develop.svn.wordpress.org/trunk@36643


git-svn-id: http://core.svn.wordpress.org/trunk@36610 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/customize/class-wp-customize-partial.php

@@ -70,11 +70,11 @@ class WP_Customize_Partial {
 	public $selector;
 
 	/**
-	 * All settings tied to the partial.
+	 * IDs for settings tied to the partial.
 	 *
 	 * @access public
 	 * @since 4.5.0
-	 * @var WP_Customize_Setting[]
+	 * @var array
 	 */
 	public $settings;
 
@@ -285,4 +285,26 @@ class WP_Customize_Partial {
 		);
 		return $exports;
 	}
+
+	/**
+	 * Checks if the user can refresh this partial.
+	 *
+	 * Returns false if the user cannot manipulate one of the associated settings,
+	 * or if one of the associated settings does not exist.
+	 *
+	 * @since 4.5.0
+	 * @access public
+	 *
+	 * @return bool False if user can't edit one one of the related settings,
+	 *                    or if one of the associated settings does not exist.
+	 */
+	final public function check_capabilities() {
+		foreach ( $this->settings as $setting_id ) {
+			$setting = $this->component->manager->get_setting( $setting_id );
+			if ( ! $setting || ! $setting->check_capabilities() ) {
+				return false;
+			}
+		}
+		return true;
+	}
 }

wp-includes/customize/class-wp-customize-selective-refresh.php

@@ -172,7 +172,9 @@ final class WP_Customize_Selective_Refresh {
 		$partials = array();
 
 		foreach ( $this->partials() as $partial ) {
-			$partials[ $partial->id ] = $partial->json();
+			if ( $partial->check_capabilities() ) {
+				$partials[ $partial->id ] = $partial->json();
+			}
 		}
 
 		$exports = array(
@@ -356,7 +358,7 @@ final class WP_Customize_Selective_Refresh {
 
 			$partial = $this->get_partial( $partial_id );
 
-			if ( ! $partial ) {
+			if ( ! $partial || ! $partial->check_capabilities() ) {
 				$contents[ $partial_id ] = null;
 				continue;
 			}

wp-includes/version.php

@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.5-alpha-36642';
+$wp_version = '4.5-alpha-36643';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.