Ticket #23216: 23216-2.patch

wp-includes/js/heartbeat.js

@@ -66 +66 @@
                 }
 
                 function isLocalFrame(frame) {
+                        var origin, src = frame.src;
+
+                        if ( src && /^https?:\/\//.test( src ) ) {
+                                origin = window.location.origin ? window.location.origin : window.location.protocol + '//' + window.location.host;
+
+                                if ( src.indexOf( origin ) !== 0 )
+                                        return false;
+                        }
+
                         try {
                                 if ( frame.contentWindow.document )
                                         return true;