Changeset 20794 for trunk/wp-includes/class-wp-customize.php

Timestamp:

05/15/2012 06:46:03 PM (13 years ago)

Author:

ryan

Message:

API for allowing cross origin resource sharing.

• Allowed origin whitelist that can be altered by plugins
• Validation of the request origin against the whitelist
• Send Access-Control-Allow-Origin if origin allowed
• get_http_origin(), get_allowed_http_origins(), is_allowed_http_origin(), send_origin_headers()

See #20681

File:

• trunk/wp-includes/class-wp-customize.php (modified) (1 diff)

trunk/wp-includes/class-wp-customize.php

@@ -72 +72 @@
             return;
 
-        $url = parse_url( admin_url() );
-        $allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
-        // @todo preserve port?
-        if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
-            $origin = $_SERVER[ 'HTTP_ORIGIN' ];
-        } else {
-            $origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
-        }
-
-        @header( 'Access-Control-Allow-Origin: ' .  $origin );
-        @header( 'Access-Control-Allow-Credentials: true' );
+        send_origin_headers();
 
         $this->start_previewing_theme();