Changeset 20741

Timestamp:

05/08/2012 08:13:34 PM (13 years ago)

Author:

koopersmith

Message:

Theme Customizer: Add cross-domain handling for when the admin and front-end are different origins. Handles both ajax and postMessage calls. props rboren, mdawaffe, nacin. see #20507, #19910.

Location:

trunk/wp-includes

Files:

• class-wp-customize.php (modified) (2 diffs)
• js/customize-controls.dev.js (modified) (2 diffs)
• js/customize-preview.dev.js (modified) (1 diff)

trunk/wp-includes/class-wp-customize.php

@@ -72 +72 @@
             return;
 
+        $url = parse_url( admin_url() );
+        $allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
+        // @todo preserve port?
+        if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
+            $origin = $_SERVER[ 'HTTP_ORIGIN' ];
+        } else {
+            $origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
+        }
+
+        @header( 'Access-Control-Allow-Origin: ' .  $origin );
+        @header( 'Access-Control-Allow-Credentials: true' );
+
         $this->start_previewing_theme();
         show_admin_bar( false );
@@ -199 +211 @@
     public function customize_preview_settings() {
         $settings = array(
-            // @todo: Perhaps grab the URL via $_POST?
-            'parent' => esc_url( admin_url( 'themes.php' ) ),
             'values' => array(),
         );

trunk/wp-includes/js/customize-controls.dev.js

@@ -312 +312 @@
             api.Messenger.prototype.initialize.call( this, params.url );
 
+            // We're dynamically generating the iframe, so the origin is set
+            // to the current window's location, not the url's.
+            this.origin.unlink( this.url ).set( window.location.href );
+
             this.bind( 'url', function( url ) {
                 // Bail if we're navigating to the current url, to a different origin, or wp-admin.
@@ -344 +348 @@
                 this.request.abort();
 
-            this.request = $.post( this.url(), this.query() || {}, function( response ) {
-                var iframe = self.loader()[0].contentWindow;
-
-                self.loader().one( 'load', self.loaded );
-
-                iframe.document.open();
-                iframe.document.write( response );
-                iframe.document.close();
-            });
+            this.request = $.ajax( this.url(), {
+                type: 'POST',
+                data: this.query() || {},
+                success: function( response ) {
+                    var iframe = self.loader()[0].contentWindow;
+
+                    self.loader().one( 'load', self.loaded );
+
+                    iframe.document.open();
+                    iframe.document.write( response );
+                    iframe.document.close();
+                },
+                xhrFields: {
+                    withCredentials: true
+                }
+            } );
         }
     });

trunk/wp-includes/js/customize-preview.dev.js

@@ -38 +38 @@
         var preview, body;
 
-        preview = new api.Preview( api.settings.parent );
+        preview = new api.Preview( window.location.href );
 
         $.each( api.settings.values, function( id, value ) {