Ticket #34451: 34451.diff

src/wp-includes/embed-functions.php

@@ -728 +728 @@
                 return false;
         }
 
-        $html = str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $iframes[1] );
-
-        preg_match( '/ src=[\'"]([^\'"]*)[\'"]/', $html, $results );
-
-        if ( ! empty( $results ) ) {
-                $secret = wp_generate_password( 10, false );
-
-                $url = esc_url( "{$results[1]}#?secret=$secret" );
-
-                $html = str_replace( $results[0], " src=\"$url\" data-secret=\"$secret\"", $html );
-        }
-
-        return $html;
+        return str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $iframes[1] );
 }
 
 /**

src/wp-includes/js/wp-embed.js

@@ -48 +48 @@
 
         function onLoad() {
                 var isIE10 = -1 !== navigator.appVersion.indexOf( 'MSIE 10' ),
-                        isIE11 = !!navigator.userAgent.match( /Trident.*rv\:11\./ );
+                        isIE11 = !!navigator.userAgent.match( /Trident.*rv:11\./ ),
+                        iframeClone, secret;
 
-                /* Remove security attribute from iframes in IE10 and IE11. */
-                if ( isIE10 || isIE11 ) {
-                        var iframes = document.querySelectorAll( '.wp-embedded-content[security]' ), iframeClone;
+                var iframes = document.querySelectorAll( '.wp-embedded-content' );
+                for ( var i = 0; i < iframes.length; i++ ) {
+                        /* Add secret to iframe */
+                        secret = Math.random().toString( 36 ).substr( 2, 10 );
+                        iframes[ i ].src += '#?secret=' + secret;
+                        iframes[ i ].setAttribute( 'data-secret', secret );
 
-                        for ( var i = 0; i < iframes.length; i++ ) {
+                        /* Remove security attribute from iframes in IE10 and IE11. */
+                        if ( !!iframes[ i ].getAttribute( 'security' ) && (isIE10 || isIE11) ) {
                                 iframeClone = iframes[ i ].cloneNode( true );
                                 iframeClone.removeAttribute( 'security' );
-                                iframes[ i ].parentNode.insertBefore( iframeClone, iframes[ i ].nextSibling );
-                                iframes[ i ].parentNode.removeChild( iframes[ i ] );
+                                iframes[ i ].parentNode.replaceChild( iframeClone, iframes[ i ] );
                         }
                 }
         }

tests/phpunit/tests/oembed/filterResult.php

@@ -16 +16 @@
                 $html   = '<p></p><iframe onload="alert(1)" src="http://example.com/sample-page/"></iframe>';
                 $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), 'http://example.com/sample-page/' );
 
-                $matches = array();
-                preg_match( '|src=".*#\?secret=([\w\d]+)" data-secret="([\w\d]+)"|', $actual, $matches );
-
-                $this->assertTrue( isset( $matches[1] ) );
-                $this->assertTrue( isset( $matches[2] ) );
-                $this->assertEquals( $matches[1], $matches[2] );
+                $this->assertEquals( '<iframe sandbox="allow-scripts" security="restricted" src="http://example.com/sample-page/"></iframe>', $actual );
         }
 
         function test_filter_oembed_result_only_one_iframe_is_allowed() {
@@ -56 +51 @@
                 $this->assertFalse( $actual );
         }
 
-        function test_filter_oembed_result_secret_param_available() {
-                $html   = '<iframe src="https://wordpress.org"></iframe>';
-                $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
-
-                $matches = array();
-                preg_match( '|src="https://wordpress.org#\?secret=([\w\d]+)" data-secret="([\w\d]+)"|', $actual, $matches );
-
-                $this->assertTrue( isset( $matches[1] ) );
-                $this->assertTrue( isset( $matches[2] ) );
-                $this->assertEquals( $matches[1], $matches[2] );
-        }
-
         function test_filter_oembed_result_wrong_type_provided() {
                 $actual = wp_filter_oembed_result( 'some string', (object) array( 'type' => 'link' ), '' );