Ticket #34462: 34462.2.diff

src/wp-includes/embed-functions.php

@@ -465 +465 @@
 
         $embed_url = get_post_embed_url( $post );
 
-        $output = "<script type='text/javascript'>\n";
+        $output = '<blockquote><a href="' . get_permalink( $post ) . '">' . get_the_title( $post ) . "</a></blockquote>\n";
+
+        $output .= "<script type='text/javascript'>\n";
         $output .= "<!--//--><![CDATA[//><!--\n";
         if ( SCRIPT_DEBUG ) {
                 $output .= file_get_contents( ABSPATH . WPINC . '/js/wp-embed.js' );
@@ -710 +712 @@
         }
 
         $allowed_html = array(
-                'iframe' => array(
+                'a'          => array(
+                                'href' => true,
+                ),
+                'blockquote' => array(),
+                'iframe'     => array(
                         'src'          => true,
                         'width'        => true,
                         'height'       => true,
@@ -724 +730 @@
         );
 
         $html = wp_kses( $result, $allowed_html );
-        preg_match( '|^.*(<iframe.*?></iframe>).*$|m', $html, $iframes );
 
-        if ( empty( $iframes ) ) {
+        preg_match( '|(<blockquote>.*?</blockquote>)?.*(<iframe.*?></iframe>)|ms', $html, $content );
+        // We require at least the iframe to exist.
+        if ( empty( $content[2] ) ) {
                 return false;
         }
+        $html = $content[1] . $content[2];
 
-        $html = str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $iframes[1] );
+        if ( ! empty( $content[1] ) ) {
+                // We have a blockquote to fall back on. Hide the iframe by default.
+                $html = str_replace( '<iframe', '<iframe style="display:none;"', $html );
+        }
 
+        $html = str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $html );
+
         preg_match( '/ src=[\'"]([^\'"]*)[\'"]/', $html, $results );
 
         if ( ! empty( $results ) ) {
@@ -740 +753 @@
                 $url = esc_url( "{$results[1]}#?secret=$secret" );
 
                 $html = str_replace( $results[0], " src=\"$url\" data-secret=\"$secret\"", $html );
+                $html = str_replace( '<blockquote', "<blockquote data-secret=\"$secret\"", $html );
         }
 
         return $html;

src/wp-includes/js/wp-embed.js

@@ -13 +13 @@
                         return;
                 }
 
-                var iframes = document.querySelectorAll( '.wp-embedded-content[data-secret="' + data.secret + '"]' );
+                var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
+                        blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
+                        i, source, height, sourceURL, targetURL;
 
-                for ( var i = 0; i < iframes.length; i++ ) {
-                        var source = iframes[ i ];
+                for ( i = 0; i < blockquotes.length; i++ ) {
+                        blockquotes[ i ].style.display = 'none';
+                }
 
+                for ( i = 0; i < iframes.length; i++ ) {
+                        source = iframes[ i ];
+
+                        source.style.display = '';
+
                         /* Resize the iframe on request. */
                         if ( 'height' === data.message ) {
-                                var height = data.value;
+                                height = data.value;
                                 if ( height > 1000 ) {
                                         height = 1000;
                                 } else if ( height < 200 ) {
@@ -32 +40 @@
 
                         /* Link to a specific URL on request. */
                         if ( 'link' === data.message ) {
-                                var sourceURL = document.createElement( 'a' ), targetURL = document.createElement( 'a' );
+                                sourceURL = document.createElement( 'a' );
+                                targetURL = document.createElement( 'a' );
+
                                 sourceURL.href = source.getAttribute( 'src' );
                                 targetURL.href = data.value;
 
@@ -48 +58 @@
 
         function onLoad() {
                 var isIE10 = -1 !== navigator.appVersion.indexOf( 'MSIE 10' ),
-                        isIE11 = !!navigator.userAgent.match( /Trident.*rv\:11\./ );
+                        isIE11 = !!navigator.userAgent.match( /Trident.*rv\:11\./ ),
+                        iframes, iframeClone, i;
 
                 /* Remove security attribute from iframes in IE10 and IE11. */
                 if ( isIE10 || isIE11 ) {
-                        var iframes = document.querySelectorAll( '.wp-embedded-content[security]' ), iframeClone;
+                        iframes = document.querySelectorAll( '.wp-embedded-content[security]' );
 
-                        for ( var i = 0; i < iframes.length; i++ ) {
+                        for ( i = 0; i < iframes.length; i++ ) {
                                 iframeClone = iframes[ i ].cloneNode( true );
                                 iframeClone.removeAttribute( 'security' );
                                 iframes[ i ].parentNode.insertBefore( iframeClone, iframes[ i ].nextSibling );

tests/phpunit/tests/oembed/filterResult.php

@@ -78 +78 @@
                 $this->assertFalse( wp_filter_oembed_result( false, (object) array( 'type' => 'rich' ), '' ) );
                 $this->assertFalse( wp_filter_oembed_result( '', (object) array( 'type' => 'rich' ), '' ) );
         }
+
+        function test_filter_oembed_result_blockquote_adds_style_to_iframe() {
+                $html   = '<blockquote></blockquote><iframe></iframe>';
+                $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
+
+                $this->assertEquals( '<blockquote></blockquote><iframe sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
+        }
+
+        function test_filter_oembed_result_allowed_html() {
+                $html   = '<blockquote><strong><a href="" target=""></a></strong></blockquote><iframe></iframe>';
+                $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' );
+
+                $this->assertEquals( '<blockquote><a href=""></a></blockquote><iframe sandbox="allow-scripts" security="restricted" style="display:none;"></iframe>', $actual );
+        }
 }