Changeset 20741

Timestamp:

05/08/2012 08:13:34 PM (14 years ago)

Author:

koopersmith

Message:

Theme Customizer: Add cross-domain handling for when the admin and front-end are different origins. Handles both ajax and postMessage calls. props rboren, mdawaffe, nacin. see #20507, #19910.

Location:

trunk/wp-includes

Files:

• class-wp-customize.php (modified) (2 diffs)
• js/customize-controls.dev.js (modified) (2 diffs)
• js/customize-preview.dev.js (modified) (1 diff)

trunk/wp-includes/class-wp-customize.php

@@ -72 +72 @@
                         return;
 
+                $url = parse_url( admin_url() );
+                $allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
+                // @todo preserve port?
+                if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
+                        $origin = $_SERVER[ 'HTTP_ORIGIN' ];
+                } else {
+                        $origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
+                }
+
+                @header( 'Access-Control-Allow-Origin: ' .  $origin );
+                @header( 'Access-Control-Allow-Credentials: true' );
+
                 $this->start_previewing_theme();
                 show_admin_bar( false );
@@ -199 +211 @@
         public function customize_preview_settings() {
                 $settings = array(
-                        // @todo: Perhaps grab the URL via $_POST?
-                        'parent' => esc_url( admin_url( 'themes.php' ) ),
                         'values' => array(),
                 );

trunk/wp-includes/js/customize-controls.dev.js

@@ -312 +312 @@
                         api.Messenger.prototype.initialize.call( this, params.url );
 
+                        // We're dynamically generating the iframe, so the origin is set
+                        // to the current window's location, not the url's.
+                        this.origin.unlink( this.url ).set( window.location.href );
+
                         this.bind( 'url', function( url ) {
                                 // Bail if we're navigating to the current url, to a different origin, or wp-admin.
@@ -344 +348 @@
                                 this.request.abort();
 
-                        this.request = $.post( this.url(), this.query() || {}, function( response ) {
-                                var iframe = self.loader()[0].contentWindow;
-
-                                self.loader().one( 'load', self.loaded );
-
-                                iframe.document.open();
-                                iframe.document.write( response );
-                                iframe.document.close();
-                        });
+                        this.request = $.ajax( this.url(), {
+                                type: 'POST',
+                                data: this.query() || {},
+                                success: function( response ) {
+                                        var iframe = self.loader()[0].contentWindow;
+
+                                        self.loader().one( 'load', self.loaded );
+
+                                        iframe.document.open();
+                                        iframe.document.write( response );
+                                        iframe.document.close();
+                                },
+                                xhrFields: {
+                                        withCredentials: true
+                                }
+                        } );
                 }
         });

trunk/wp-includes/js/customize-preview.dev.js

@@ -38 +38 @@
                 var preview, body;
 
-                preview = new api.Preview( api.settings.parent );
+                preview = new api.Preview( window.location.href );
 
                 $.each( api.settings.values, function( id, value ) {