Skip to content

Commit c01143d

Browse files
adamsilversteinadamsilverstein
committed
Media: Broaden DIP header to all admin and preview pages
Send the Document-Isolation-Policy header on all admin pages and front-end preview pages instead of only specific editor screens. This keeps all admin navigations (site editor, template operations, pattern editing) and preview popups in the same agent cluster, preserving cross-window communication in Chromium 137+.
1 parent f6d5a85 commit c01143d

3 files changed

Lines changed: 64 additions & 16 deletions

File tree

‎src/wp-includes/default-filters.php‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -682,10 +682,8 @@
682682
// Client-side media processing.
683683
add_action( 'admin_init', 'wp_set_client_side_media_processing_flag' );
684684
// Cross-origin isolation for client-side media processing.
685-
add_action( 'load-post.php', 'wp_set_up_cross_origin_isolation' );
686-
add_action( 'load-post-new.php', 'wp_set_up_cross_origin_isolation' );
687-
add_action( 'load-site-editor.php', 'wp_set_up_cross_origin_isolation' );
688-
add_action( 'load-widgets.php', 'wp_set_up_cross_origin_isolation' );
685+
add_action( 'admin_init', 'wp_set_up_cross_origin_isolation' );
686+
add_action( 'template_redirect', 'wp_set_up_cross_origin_isolation_for_preview' );
689687
// Nav menu.
690688
add_filter( 'nav_menu_item_id', '_nav_menu_item_id_use_once', 10, 2 );
691689
add_filter( 'nav_menu_css_class', 'wp_nav_menu_remove_menu_item_has_children_class', 10, 4 );

‎src/wp-includes/media.php‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6475,12 +6475,17 @@ function wp_get_chromium_major_version(): ?int {
64756475
}
64766476

64776477
/**
6478-
* Enables cross-origin isolation in the block editor.
6478+
* Enables cross-origin isolation on admin pages.
64796479
*
64806480
* Required for enabling SharedArrayBuffer for WebAssembly-based
64816481
* media processing in the editor. Uses Document-Isolation-Policy
64826482
* on supported browsers (Chromium 137+).
64836483
*
6484+
* Applied to all admin pages so that navigations between editor pages
6485+
* and other admin screens (site editor, template operations, pattern
6486+
* editing) remain in the same agent cluster, preserving cross-window
6487+
* communication.
6488+
*
64846489
* Skips setup when a third-party page builder overrides the block
64856490
* editor via a custom `action` query parameter, as DIP would block
64866491
* same-origin iframe access that these editors rely on.
@@ -6492,13 +6497,8 @@ function wp_set_up_cross_origin_isolation(): void {
64926497
return;
64936498
}
64946499

6495-
$screen = get_current_screen();
6496-
6497-
if ( ! $screen ) {
6498-
return;
6499-
}
6500-
6501-
if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
6500+
// Cross-origin isolation is not needed if users can't upload files anyway.
6501+
if ( ! current_user_can( 'upload_files' ) ) {
65026502
return;
65036503
}
65046504

@@ -6511,7 +6511,28 @@ function wp_set_up_cross_origin_isolation(): void {
65116511
return;
65126512
}
65136513

6514-
// Cross-origin isolation is not needed if users can't upload files anyway.
6514+
wp_start_cross_origin_isolation_output_buffer();
6515+
}
6516+
6517+
/**
6518+
* Sets up cross-origin isolation for front-end preview pages.
6519+
*
6520+
* When the block editor sends the Document-Isolation-Policy header and opens
6521+
* a preview popup, the preview page must also send the header to remain in
6522+
* the same agent cluster. Without this, cross-window communication between
6523+
* the editor and preview breaks in Chromium 137+.
6524+
*
6525+
* @since 7.1.0
6526+
*/
6527+
function wp_set_up_cross_origin_isolation_for_preview(): void {
6528+
if ( ! is_preview() ) {
6529+
return;
6530+
}
6531+
6532+
if ( ! wp_is_client_side_media_processing_enabled() ) {
6533+
return;
6534+
}
6535+
65156536
if ( ! current_user_can( 'upload_files' ) ) {
65166537
return;
65176538
}

‎tests/phpunit/tests/media/wpCrossOriginIsolation.php‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*
66
* @group media
77
* @covers ::wp_set_up_cross_origin_isolation
8+
* @covers ::wp_set_up_cross_origin_isolation_for_preview
89
* @covers ::wp_start_cross_origin_isolation_output_buffer
910
* @covers ::wp_is_client_side_media_processing_enabled
1011
*/
@@ -89,13 +90,15 @@ public function test_returns_early_when_client_side_processing_disabled() {
8990
/**
9091
* @ticket 64766
9192
*/
92-
public function test_returns_early_when_no_screen() {
93-
// No screen is set, so it should return early.
93+
public function test_returns_early_when_user_cannot_upload() {
94+
$user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
95+
wp_set_current_user( $user_id );
96+
9497
$level_before = ob_get_level();
9598
wp_set_up_cross_origin_isolation();
9699
$level_after = ob_get_level();
97100

98-
$this->assertSame( $level_before, $level_after );
101+
$this->assertSame( $level_before, $level_after, 'Output buffer should not start for users who cannot upload files.' );
99102
}
100103

101104
/**
@@ -210,4 +213,30 @@ public function test_output_buffer_adds_crossorigin_attributes() {
210213

211214
$this->assertStringContainsString( 'crossorigin="anonymous"', $output );
212215
}
216+
217+
/**
218+
* @ticket 64766
219+
*/
220+
public function test_preview_returns_early_when_not_preview() {
221+
add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
222+
223+
$level_before = ob_get_level();
224+
wp_set_up_cross_origin_isolation_for_preview();
225+
$level_after = ob_get_level();
226+
227+
$this->assertSame( $level_before, $level_after, 'Output buffer should not start on non-preview pages.' );
228+
}
229+
230+
/**
231+
* @ticket 64766
232+
*/
233+
public function test_preview_returns_early_when_processing_disabled() {
234+
add_filter( 'wp_client_side_media_processing_enabled', '__return_false' );
235+
236+
$level_before = ob_get_level();
237+
wp_set_up_cross_origin_isolation_for_preview();
238+
$level_after = ob_get_level();
239+
240+
$this->assertSame( $level_before, $level_after, 'Output buffer should not start when client-side processing is disabled.' );
241+
}
213242
}

0 commit comments

Comments
 (0)