Ticket #28195: 28195.14.patch

src/wp-admin/includes/ajax-actions.php

@@ -2530 +2530 @@
                 wp_send_json_error();
         }
 
-        if ( ! current_user_can( 'read_post', $post->ID ) ) {
+        if ( empty( $_POST['shortcode'] ) || ! current_user_can( 'read_post', $post->ID ) ) {
                 wp_send_json_error();
         }
 
         setup_postdata( $post );
 
-        $parsed = $wp_embed->run_shortcode( $_POST['content'] );
+        // If the URL cannot be embedded, return eror message with call wp_send_json_error()
+        add_filter( 'embed_maybe_make_link', '_wpview_embed_error', 20, 2 );
+
+        $parsed = $wp_embed->run_shortcode( $_POST['shortcode'] );
         $parsed = do_shortcode( $parsed );
 
         wp_send_json_success( $parsed );

src/wp-admin/includes/misc.php

@@ -824 +824 @@
 }
 // Run later as we have to set DOING_AUTOSAVE for back-compat
 add_filter( 'heartbeat_received', 'heartbeat_autosave', 500, 2 );
+
+/**
+ * Send error message when an URL cannot be embedded. Used in wp_ajax_parse_embed().
+ *
+ * @access private
+ * @since 4.0
+ */
+function _wpview_embed_error( $output, $url ) {
+        wp_send_json_error( array(
+                'message' => sprintf( __( '%s failed to embed.' ), esc_url( $url ) ),
+        ) );
+}

src/wp-includes/js/mce-view.js

@@ -719 +719 @@
                         wp.ajax.send( 'parse-embed', {
                                 data: {
                                         post_ID: $( '#post_ID' ).val(),
-                                        content: this.shortcode
+                                        type: self.type,
+                                        shortcode: this.shortcode
                                 }
                         } )
-                        .done( function( content ) {
+                        .always( function() {
                                 self.fetching = false;
-
-                                if ( content.substring( 0, ( '<a href' ).length ) === '<a href' ) {
+                        } )
+                        .done( function( response ) {
+                                if ( response ) {
+                                        self.parsed = response;
+                                        self.setHtml( response );
+                                }
+                        } )
+                        .fail( function( response ) {
+                                if ( response && response.message ) {
                                         if ( self.type === 'embed' ) {
-                                                self.setError( self.original + ' failed to embed.', 'admin-media' );
+                                                self.setError( response.message, 'admin-media' );
                                         } else {
-                                                self.setContent( self.original, null, true );
+                                                self.setContent( '<p>' + self.original + '</p>', null, true );
                                         }
-                                } else {
-                                        self.parsed = content;
-                                        self.setHtml( content );
+                                } else if ( response && response.statusText ) {
+                                        self.setError( response.statusText, 'admin-media' );
                                 }
-                        } )
-                        .fail( function() {
-                                self.fetching = false;
-                                self.setError( self.original + ' failed to embed due to a server error.', 'admin-media' );
                         } );
                 },
                 /* jshint scripturl: true */