Changeset 20741 for trunk/wp-includes/class-wp-customize.php

Timestamp:

05/08/2012 08:13:34 PM (14 years ago)

Author:

koopersmith

Message:

Theme Customizer: Add cross-domain handling for when the admin and front-end are different origins. Handles both ajax and postMessage calls. props rboren, mdawaffe, nacin. see #20507, #19910.

File:

• trunk/wp-includes/class-wp-customize.php (modified) (2 diffs)

trunk/wp-includes/class-wp-customize.php

@@ -72 +72 @@
                         return;
 
+                $url = parse_url( admin_url() );
+                $allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
+                // @todo preserve port?
+                if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
+                        $origin = $_SERVER[ 'HTTP_ORIGIN' ];
+                } else {
+                        $origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
+                }
+
+                @header( 'Access-Control-Allow-Origin: ' .  $origin );
+                @header( 'Access-Control-Allow-Credentials: true' );
+
                 $this->start_previewing_theme();
                 show_admin_bar( false );
@@ -199 +211 @@
         public function customize_preview_settings() {
                 $settings = array(
-                        // @todo: Perhaps grab the URL via $_POST?
-                        'parent' => esc_url( admin_url( 'themes.php' ) ),
                         'values' => array(),
                 );