Ticket #40020: 40020.diff

src/wp-includes/class-wp-customize-manager.php

@@ -1895 +1895 @@
          * @return array Headers.
          */
         public function filter_iframe_security_headers( $headers ) {
-                $customize_url                      = admin_url( 'customize.php' );
-                $headers['X-Frame-Options']         = 'ALLOW-FROM ' . $customize_url;
-                $headers['Content-Security-Policy'] = 'frame-ancestors ' . preg_replace( '#^(\w+://[^/]+).+?$#', '$1', $customize_url );
+                $headers['X-Frame-Options']         = 'SAMEORIGIN';
+                $headers['Content-Security-Policy'] = "frame-ancestors 'self'";
                 return $headers;
         }