Changeset 20886

Timestamp:

05/24/2012 09:13:21 PM (14 years ago)

Author:

koopersmith

Message:

Theme Customizer: Check for CORS support when the preview and admin urls are cross-domain. Add a fallback to the customize control frame, and check support there as well. see #20582, #19910.

Location:

trunk

Files:

• wp-admin/customize.php (modified) (2 diffs)
• wp-includes/js/customize-base.dev.js (modified) (1 diff)
• wp-includes/js/customize-controls.dev.js (modified) (1 diff)
• wp-includes/js/customize-loader.dev.js (modified) (6 diffs)
• wp-includes/theme.php (modified) (1 diff)

trunk/wp-admin/customize.php

@@ -108 +108 @@
         $admin_origin = parse_url( admin_url() );
         $home_origin  = parse_url( home_url() );
+        $cross_domain = ( strtolower( $admin_origin[ 'host' ] ) != strtolower( $home_origin[ 'host' ] ) );
 
-        if ( is_ssl() && ( $admin_origin[ 'host' ] == $home_origin[ 'host' ] ) )
+        if ( is_ssl() && ! $cross_domain )
                 $allowed_urls[] = home_url( '/', 'https' );
 
         $allowed_urls = array_unique( apply_filters( 'customize_allowed_urls', $allowed_urls ) );
+
+        $fallback_url = add_query_arg( array(
+                'preview'        => 1,
+                'template'       => $wp_customize->get_template(),
+                'stylesheet'     => $wp_customize->get_stylesheet(),
+                'preview_iframe' => true,
+                'TB_iframe'      => 'true'
+        ), home_url( '/' ) );
 
         $settings = array(
@@ -120 +129 @@
                 ),
                 'url'      => array(
-                        'preview'  => esc_url( home_url( '/' ) ),
-                        'parent'   => esc_url( admin_url() ),
-                        'ajax'     => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
-                        'allowed'  => array_map( 'esc_url', $allowed_urls ),
+                        'preview'       => esc_url( home_url( '/' ) ),
+                        'parent'        => esc_url( admin_url() ),
+                        'ajax'          => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
+                        'allowed'       => array_map( 'esc_url', $allowed_urls ),
+                        'isCrossDomain' => $cross_domain,
+                        'fallback'      => $fallback_url,
                 ),
                 'settings' => array(),

trunk/wp-includes/js/customize-base.dev.js

@@ -475 +475 @@
          * ===================================================================== */
 
+        $.support.postMessage = !! window.postMessage;
+
         api.Messenger = api.Class.extend({
                 add: function( key, initial, options ) {

trunk/wp-includes/js/customize-controls.dev.js

@@ -442 +442 @@
                 if ( ! api.settings )
                         return;
+
+                if ( ! $.support.postMessage || ( ! $.support.cors && api.settings.isCrossDomain ) )
+                        return window.location = api.settings.url.fallback;
 
                 // Initialize Previewer

trunk/wp-includes/js/customize-loader.dev.js

@@ -6 +6 @@
                 Loader;
 
+        $.extend( $.support, {
+                history: !! ( window.history && history.pushState ),
+                hashchange: ('onhashchange' in window) && (document.documentMode === undefined || document.documentMode > 7)
+        });
+
         Loader = $.extend( {}, api.Events, {
-                supports: {
-                        history:  !! ( window.history && history.pushState ),
-                        hashchange: ('onhashchange' in window) && (document.documentMode === undefined || document.documentMode > 7)
-                },
+                initialize: function() {
+                        this.body = $( document.body );
 
-                initialize: function() {
-                        this.body    = $( document.body ).addClass('customize-support');
+                        // Ensure the loader is supported.
+                        // Check for settings, postMessage support, and whether we require CORS support.
+                        if ( ! Loader.settings || ! $.support.postMessage || ( ! $.support.cors && Loader.settings.isCrossDomain ) ) {
+                                this.body.removeClass( 'customize-support' ).addClass( 'no-customize-support' );
+                                return;
+                        }
+
+                        this.body.removeClass( 'no-customize-support' ).addClass( 'customize-support' );
+
                         this.window  = $( window );
                         this.element = $( '<div id="customize-container" class="wp-full-overlay" />' ).appendTo( this.body );
@@ -28 +38 @@
 
                         // Add navigation listeners.
-                        if ( this.supports.history )
+                        if ( $.support.history )
                                 this.window.on( 'popstate', Loader.popstate );
 
-                        if ( this.supports.hashchange )
+                        if ( $.support.hashchange )
                                 this.window.on( 'hashchange', Loader.hashchange );
                 },
@@ -49 +59 @@
                                 Loader.open( wpCustomizeLoaderL10n.url + '?' + hash );
 
-                        if ( ! hash && ! Loader.supports.history )
+                        if ( ! hash && ! $.support.history )
                                 Loader.close();
                 },
@@ -74 +84 @@
 
                         this.messenger.bind( 'close', function() {
-                                if ( Loader.supports.history )
+                                if ( $.support.history )
                                         history.back();
-                                else if ( Loader.supports.hashchange )
+                                else if ( $.support.hashchange )
                                         window.location.hash = '';
                                 else
@@ -85 +95 @@
 
                         // Ensure we don't call pushState if the user hit the forward button.
-                        if ( Loader.supports.history && window.location.href !== src )
+                        if ( $.support.history && window.location.href !== src )
                                 history.pushState( { customize: src }, '', src );
-                        else if ( ! Loader.supports.history && Loader.supports.hashchange && hash )
+                        else if ( ! $.support.history && $.support.hashchange && hash )
                                 window.location.hash = hash;
 
@@ -129 +139 @@
 
         $( function() {
-                if ( window.postMessage )
-                        Loader.initialize();
+                Loader.settings = _wpCustomizeLoaderSettings;
+                Loader.initialize();
         });
 

trunk/wp-includes/theme.php

@@ -1585 +1585 @@
 
 /**
- * Localizes the customize-loader script.
+ * Adds settings for the customize-loader script.
  *
  * @since 3.4.0
  */
-function _wp_customize_loader_localize() {
-        wp_localize_script( 'customize-loader', 'wpCustomizeLoaderL10n', array(
-                'url' => admin_url( 'admin.php' ),
-        ) );
-}
-add_action( 'admin_enqueue_scripts', '_wp_customize_loader_localize' );
+function _wp_customize_loader_settings() {
+        global $wp_scripts;
+
+        $admin_origin = parse_url( admin_url() );
+        $home_origin  = parse_url( home_url() );
+        $cross_domain = ( strtolower( $admin_origin[ 'host' ] ) != strtolower( $home_origin[ 'host' ] ) );
+
+        $settings = array(
+                'url'           => esc_url( admin_url( 'admin.php' ) ),
+                'isCrossDomain' => $cross_domain,
+        );
+
+        $script = 'var _wpCustomizeLoaderSettings = ' . json_encode( $settings ) . ';';
+
+        $data = $wp_scripts->get_data( 'customize-loader', 'data' );
+        if ( $data )
+                $script = "$data\n$script";
+
+        $wp_scripts->add_data( 'customize-loader', 'data', $script );
+}
+add_action( 'admin_enqueue_scripts', '_wp_customize_loader_settings' );
 
 /**