Ticket #34451: 34451.4.diff

src/wp-includes/embed-functions.php

@@ -460 +460 @@
 
         $embed_url = get_post_embed_url( $post );
 
-        $output = '<blockquote><a href="' . get_permalink( $post ) . '">' . get_the_title( $post ) . "</a></blockquote>\n";
+        $output = '<blockquote class="wp-embedded-content"><a href="' . esc_url( get_permalink( $post ) ) . '">' . get_the_title( $post ) . "</a></blockquote>\n";
 
         $output .= "<script type='text/javascript'>\n";
         $output .= "<!--//--><![CDATA[//><!--\n";
@@ -754 +754 @@
 
         $allowed_html = array(
                 'a'          => array(
-                                'href' => true,
+                        'href'         => true,
                 ),
                 'blockquote' => array(),
                 'iframe'     => array(
@@ -766 +766 @@
                         'marginheight' => true,
                         'scrolling'    => true,
                         'title'        => true,
-                        'class'        => true,
                 ),
         );
 
@@ -782 +781 @@
         if ( ! empty( $content[1] ) ) {
                 // We have a blockquote to fall back on. Hide the iframe by default.
                 $html = str_replace( '<iframe', '<iframe style="display:none;"', $html );
+                $html = str_replace( '<blockquote', '<blockquote class="wp-embedded-content"', $html );
         }
 
-        $html = str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $html );
+        $html = str_replace( '<iframe', '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"', $html );
 
         preg_match( '/ src=[\'"]([^\'"]*)[\'"]/', $html, $results );
 

src/wp-includes/js/wp-embed-template.js

@@ -1 +1 @@
 (function ( window, document ) {
         'use strict';
 
-        var secret = window.location.hash.replace( /.*secret=([\d\w]{10}).*/, '$1' ),
-                supportedBrowser = ( document.querySelector && window.addEventListener ),
+        var supportedBrowser = ( document.querySelector && window.addEventListener ),
                 loaded = false,
+                secret,
+                secretTimeout,
                 resizing;
 
         function sendEmbedMessage( message, value ) {
@@ -163 +164 @@
                 }, 100 );
         }
 
+        /**
+         * Re-get the secret when it was added later on.
+         */
+        function getSecret() {
+                if ( window.self === window.top || !!secret ) {
+                        return;
+                }
+
+                secret = window.location.hash.replace( /.*secret=([\d\w]{10}).*/, '$1' );
+
+                clearTimeout( secretTimeout );
+
+                secretTimeout = setTimeout( function () {
+                        getSecret();
+                }, 100 );
+        }
+
         if ( supportedBrowser ) {
+                getSecret();
                 document.documentElement.className = document.documentElement.className.replace( /\bno-js\b/, '' ) + ' js';
                 document.addEventListener( 'DOMContentLoaded', onLoad, false );
                 window.addEventListener( 'load', onLoad, false );

src/wp-includes/js/wp-embed.js

@@ -64 +64 @@
                 loaded = true;
 
                 var isIE10 = -1 !== navigator.appVersion.indexOf( 'MSIE 10' ),
-                        isIE11 = !!navigator.userAgent.match( /Trident.*rv\:11\./ ),
-                        iframes, iframeClone, i;
+                        isIE11 = !!navigator.userAgent.match( /Trident.*rv:11\./ ),
+                        iframes = document.querySelectorAll( 'iframe.wp-embedded-content' ),
+                        blockquotes = document.querySelectorAll( 'blockquote.wp-embedded-content' ),
+                        iframeClone, i, source, secret;
 
-                /* Remove security attribute from iframes in IE10 and IE11. */
-                if ( isIE10 || isIE11 ) {
-                        iframes = document.querySelectorAll( '.wp-embedded-content[security]' );
+                for ( i = 0; i < blockquotes.length; i++ ) {
+                        blockquotes[ i ].style.display = 'none';
+                }
+
+                for ( i = 0; i < iframes.length; i++ ) {
+                        source = iframes[ i ];
+                        source.style.display = '';
+
+                        if ( !source.getAttribute( 'data-secret' ) ) {
+                                /* Add secret to iframe */
+                                secret = Math.random().toString( 36 ).substr( 2, 10 );
+                                source.src += '#?secret=' + secret;
+                                source.setAttribute( 'data-secret', secret );
+                        }
 
-                        for ( i = 0; i < iframes.length; i++ ) {
-                                iframeClone = iframes[ i ].cloneNode( true );
+                        /* Remove security attribute from iframes in IE10 and IE11. */
+                        if ( ( isIE10 || isIE11 ) && !!source.getAttribute( 'security' ) ) {
+                                iframeClone = source.cloneNode( true );
                                 iframeClone.removeAttribute( 'security' );
-                                iframes[ i ].parentNode.replaceChild( iframeClone, iframes[ i ] );
+                                source.parentNode.replaceChild( iframeClone, source );
                         }
                 }
         }

tests/phpunit/tests/oembed/filterResult.php

@@ -28 +28 @@
                 $html   = '<div><iframe></iframe><iframe></iframe><p></p></div>';
                 $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
 
-                $this->assertEquals( '<iframe sandbox="allow-scripts" security="restricted"></iframe>', $actual );
+                $this->assertEquals( '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"></iframe>', $actual );
         }
 
         function test_filter_oembed_result_with_newlines() {
@@ -41 +41 @@
 
                 $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
 
-                $this->assertEquals( '<iframe sandbox="allow-scripts" security="restricted"></iframe>', $actual );
+                $this->assertEquals( '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"></iframe>', $actual );
         }
 
         function test_filter_oembed_result_without_iframe() {
@@ -83 +83 @@
                 $html   = '<blockquote></blockquote><iframe></iframe>';
                 $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
 
-                $this->assertEquals( '<blockquote></blockquote><iframe sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
+                $this->assertEquals( '<blockquote class="wp-embedded-content"></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
         }
 
         function test_filter_oembed_result_allowed_html() {
-                $html   = '<blockquote><strong><a href="" target=""></a></strong></blockquote><iframe></iframe>';
+                $html   = '<blockquote class="foo" id="bar"><strong><a href="" target=""></a></strong></blockquote><iframe></iframe>';
                 $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
 
-                $this->assertEquals( '<blockquote><a href=""></a></blockquote><iframe sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
+                $this->assertEquals( '<blockquote class="wp-embedded-content"><a href=""></a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
         }
 }