Ticket #34831: 34831.3.diff

wp-includes/js/wp-embed.js

@@ -22 +22 @@
                         return;
                 }
 
+                if ( /[^a-zA-Z0-9]/.test( data.secret ) ) {
+                        return;
+                }
+
                 var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
                         blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
                         i, source, height, sourceURL, targetURL;
@@ -33 +37 @@
                 for ( i = 0; i < iframes.length; i++ ) {
                         source = iframes[ i ];
 
+                        if ( e.source !== source.contentWindow ) {
+                                continue;
+                        }
+
                         source.style.display = '';
 
                         /* Resize the iframe on request. */