Ticket #40011: 40011.diff

src/wp-includes/rest-api.php

@@ -525 +525 @@
         $origin = get_http_origin();
 
         if ( $origin ) {
-                header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
+                if ( 'null' !== $origin ) {
+                        $origin = esc_url_raw( $origin );
+                }
+                header( 'Access-Control-Allow-Origin: ' . $origin );
                 header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
                 header( 'Access-Control-Allow-Credentials: true' );
                 header( 'Vary: Origin' );