Skip to content

Commit 7962e83

Browse files
adamsilversteinadamsilverstein
committed
Media: Broaden the Document-Isolation-Policy header to all admin pages.
Send the Document-Isolation-Policy (DIP) header on every admin page via `admin_init` rather than only on the four block-editor screens (`load-post.php`, `load-post-new.php`, `load-site-editor.php`, and `load-widgets.php`). Hooking the narrow set of screens placed the editor in its own browser agent cluster while sibling admin navigations (site editor sub-routes, template and pattern operations) loaded without the header. The agent cluster mismatch broke cross-window communication and SharedArrayBuffer access required for WebAssembly-based client-side media processing in Chromium 137+. The block-editor screen gate is replaced by an `upload_files` capability check, since cross-origin isolation is only needed for users who can upload media. The existing escape hatch for third-party page builders that override the block editor via a custom `action` query parameter is retained. The front-end preview is intentionally out of scope; DIP remains an admin-only concern. See related Gutenberg pull request: WordPress/gutenberg#76662.
1 parent e904e28 commit 7962e83

3 files changed

Lines changed: 14 additions & 20 deletions

File tree

‎src/wp-includes/default-filters.php‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -698,10 +698,7 @@
698698
// Client-side media processing.
699699
add_action( 'admin_init', 'wp_set_client_side_media_processing_flag' );
700700
// Cross-origin isolation for client-side media processing.
701-
add_action( 'load-post.php', 'wp_set_up_cross_origin_isolation' );
702-
add_action( 'load-post-new.php', 'wp_set_up_cross_origin_isolation' );
703-
add_action( 'load-site-editor.php', 'wp_set_up_cross_origin_isolation' );
704-
add_action( 'load-widgets.php', 'wp_set_up_cross_origin_isolation' );
701+
add_action( 'admin_init', 'wp_set_up_cross_origin_isolation' );
705702
// Nav menu.
706703
add_filter( 'nav_menu_item_id', '_nav_menu_item_id_use_once', 10, 2 );
707704
add_filter( 'nav_menu_css_class', 'wp_nav_menu_remove_menu_item_has_children_class', 10, 4 );

‎src/wp-includes/media.php‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6533,12 +6533,17 @@ function wp_get_chromium_major_version(): ?int {
65336533
}
65346534

65356535
/**
6536-
* Enables cross-origin isolation in the block editor.
6536+
* Enables cross-origin isolation on admin pages.
65376537
*
65386538
* Required for enabling SharedArrayBuffer for WebAssembly-based
65396539
* media processing in the editor. Uses Document-Isolation-Policy
65406540
* on supported browsers (Chromium 137+).
65416541
*
6542+
* Applied to all admin pages so that navigations between editor pages
6543+
* and other admin screens (site editor, template operations, pattern
6544+
* editing) remain in the same agent cluster, preserving cross-window
6545+
* communication.
6546+
*
65426547
* Skips setup when a third-party page builder overrides the block
65436548
* editor via a custom `action` query parameter, as DIP would block
65446549
* same-origin iframe access that these editors rely on.
@@ -6550,13 +6555,8 @@ function wp_set_up_cross_origin_isolation(): void {
65506555
return;
65516556
}
65526557

6553-
$screen = get_current_screen();
6554-
6555-
if ( ! $screen ) {
6556-
return;
6557-
}
6558-
6559-
if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
6558+
// Cross-origin isolation is not needed if users can't upload files anyway.
6559+
if ( ! current_user_can( 'upload_files' ) ) {
65606560
return;
65616561
}
65626562

@@ -6569,11 +6569,6 @@ function wp_set_up_cross_origin_isolation(): void {
65696569
return;
65706570
}
65716571

6572-
// Cross-origin isolation is not needed if users can't upload files anyway.
6573-
if ( ! current_user_can( 'upload_files' ) ) {
6574-
return;
6575-
}
6576-
65776572
wp_start_cross_origin_isolation_output_buffer();
65786573
}
65796574

‎tests/phpunit/tests/media/wpCrossOriginIsolation.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,15 @@ public function test_returns_early_when_client_side_processing_disabled() {
8989
/**
9090
* @ticket 64766
9191
*/
92-
public function test_returns_early_when_no_screen() {
93-
// No screen is set, so it should return early.
92+
public function test_returns_early_when_user_cannot_upload() {
93+
$user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
94+
wp_set_current_user( $user_id );
95+
9496
$level_before = ob_get_level();
9597
wp_set_up_cross_origin_isolation();
9698
$level_after = ob_get_level();
9799

98-
$this->assertSame( $level_before, $level_after );
100+
$this->assertSame( $level_before, $level_after, 'Output buffer should not start for users who cannot upload files.' );
99101
}
100102

101103
/**

0 commit comments

Comments
 (0)