Ticket #20507: 20507.3.diff

wp-includes/class-wp-customize.php

@@ -71 +71 @@
                 if ( ! isset( $_REQUEST['customize'] ) || 'on' != $_REQUEST['customize'] )
                         return;
 
+                $url = parse_url( admin_url() );
+                $allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
+                // @todo preserve port?
+                if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) )
+                        $origin = $_SERVER[ 'HTTP_ORIGIN' ];
+                else
+                        $origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
+
+                @header( 'Access-Control-Allow-Origin: ' .  $origin );
+
                 $this->start_previewing_theme();
                 show_admin_bar( false );
         }