Changeset 20886

Timestamp:

05/24/2012 09:13:21 PM (13 years ago)

Author:

koopersmith

Message:

Theme Customizer: Check for CORS support when the preview and admin urls are cross-domain. Add a fallback to the customize control frame, and check support there as well. see #20582, #19910.

Location:

trunk

Files:

• wp-admin/customize.php (modified) (2 diffs)
• wp-includes/js/customize-base.dev.js (modified) (1 diff)
• wp-includes/js/customize-controls.dev.js (modified) (1 diff)
• wp-includes/js/customize-loader.dev.js (modified) (6 diffs)
• wp-includes/theme.php (modified) (1 diff)

trunk/wp-admin/customize.php

@@ -108 +108 @@
     $admin_origin = parse_url( admin_url() );
     $home_origin  = parse_url( home_url() );
+    $cross_domain = ( strtolower( $admin_origin[ 'host' ] ) != strtolower( $home_origin[ 'host' ] ) );
 
-    if ( is_ssl() && ( $admin_origin[ 'host' ] == $home_origin[ 'host' ] ) )
+    if ( is_ssl() && ! $cross_domain )
         $allowed_urls[] = home_url( '/', 'https' );
 
     $allowed_urls = array_unique( apply_filters( 'customize_allowed_urls', $allowed_urls ) );
+
+    $fallback_url = add_query_arg( array(
+        'preview'        => 1,
+        'template'       => $wp_customize->get_template(),
+        'stylesheet'     => $wp_customize->get_stylesheet(),
+        'preview_iframe' => true,
+        'TB_iframe'      => 'true'
+    ), home_url( '/' ) );
 
     $settings = array(
@@ -120 +129 @@
         ),
         'url'      => array(
-            'preview'  => esc_url( home_url( '/' ) ),
-            'parent'   => esc_url( admin_url() ),
-            'ajax'     => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
-            'allowed'  => array_map( 'esc_url', $allowed_urls ),
+            'preview'       => esc_url( home_url( '/' ) ),
+            'parent'        => esc_url( admin_url() ),
+            'ajax'          => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
+            'allowed'       => array_map( 'esc_url', $allowed_urls ),
+            'isCrossDomain' => $cross_domain,
+            'fallback'      => $fallback_url,
         ),
         'settings' => array(),

trunk/wp-includes/js/customize-base.dev.js

@@ -475 +475 @@
      * ===================================================================== */
 
+    $.support.postMessage = !! window.postMessage;
+
     api.Messenger = api.Class.extend({
         add: function( key, initial, options ) {

trunk/wp-includes/js/customize-controls.dev.js

@@ -442 +442 @@
         if ( ! api.settings )
             return;
+
+        if ( ! $.support.postMessage || ( ! $.support.cors && api.settings.isCrossDomain ) )
+            return window.location = api.settings.url.fallback;
 
         // Initialize Previewer

trunk/wp-includes/js/customize-loader.dev.js

@@ -6 +6 @@
         Loader;
 
+    $.extend( $.support, {
+        history: !! ( window.history && history.pushState ),
+        hashchange: ('onhashchange' in window) && (document.documentMode === undefined || document.documentMode > 7)
+    });
+
     Loader = $.extend( {}, api.Events, {
-        supports: {
-            history:  !! ( window.history && history.pushState ),
-            hashchange: ('onhashchange' in window) && (document.documentMode === undefined || document.documentMode > 7)
-        },
+        initialize: function() {
+            this.body = $( document.body );
 
-        initialize: function() {
-            this.body    = $( document.body ).addClass('customize-support');
+            // Ensure the loader is supported.
+            // Check for settings, postMessage support, and whether we require CORS support.
+            if ( ! Loader.settings || ! $.support.postMessage || ( ! $.support.cors && Loader.settings.isCrossDomain ) ) {
+                this.body.removeClass( 'customize-support' ).addClass( 'no-customize-support' );
+                return;
+            }
+
+            this.body.removeClass( 'no-customize-support' ).addClass( 'customize-support' );
+
             this.window  = $( window );
             this.element = $( '<div id="customize-container" class="wp-full-overlay" />' ).appendTo( this.body );
@@ -28 +38 @@
 
             // Add navigation listeners.
-            if ( this.supports.history )
+            if ( $.support.history )
                 this.window.on( 'popstate', Loader.popstate );
 
-            if ( this.supports.hashchange )
+            if ( $.support.hashchange )
                 this.window.on( 'hashchange', Loader.hashchange );
         },
@@ -49 +59 @@
                 Loader.open( wpCustomizeLoaderL10n.url + '?' + hash );
 
-            if ( ! hash && ! Loader.supports.history )
+            if ( ! hash && ! $.support.history )
                 Loader.close();
         },
@@ -74 +84 @@
 
             this.messenger.bind( 'close', function() {
-                if ( Loader.supports.history )
+                if ( $.support.history )
                     history.back();
-                else if ( Loader.supports.hashchange )
+                else if ( $.support.hashchange )
                     window.location.hash = '';
                 else
@@ -85 +95 @@
 
             // Ensure we don't call pushState if the user hit the forward button.
-            if ( Loader.supports.history && window.location.href !== src )
+            if ( $.support.history && window.location.href !== src )
                 history.pushState( { customize: src }, '', src );
-            else if ( ! Loader.supports.history && Loader.supports.hashchange && hash )
+            else if ( ! $.support.history && $.support.hashchange && hash )
                 window.location.hash = hash;
 
@@ -129 +139 @@
 
     $( function() {
-        if ( window.postMessage )
-            Loader.initialize();
+        Loader.settings = _wpCustomizeLoaderSettings;
+        Loader.initialize();
     });
 

trunk/wp-includes/theme.php

@@ -1585 +1585 @@
 
 /**
- * Localizes the customize-loader script.
+ * Adds settings for the customize-loader script.
  *
  * @since 3.4.0
  */
-function _wp_customize_loader_localize() {
-    wp_localize_script( 'customize-loader', 'wpCustomizeLoaderL10n', array(
-        'url' => admin_url( 'admin.php' ),
-    ) );
-}
-add_action( 'admin_enqueue_scripts', '_wp_customize_loader_localize' );
+function _wp_customize_loader_settings() {
+    global $wp_scripts;
+
+    $admin_origin = parse_url( admin_url() );
+    $home_origin  = parse_url( home_url() );
+    $cross_domain = ( strtolower( $admin_origin[ 'host' ] ) != strtolower( $home_origin[ 'host' ] ) );
+
+    $settings = array(
+        'url'           => esc_url( admin_url( 'admin.php' ) ),
+        'isCrossDomain' => $cross_domain,
+    );
+
+    $script = 'var _wpCustomizeLoaderSettings = ' . json_encode( $settings ) . ';';
+
+    $data = $wp_scripts->get_data( 'customize-loader', 'data' );
+    if ( $data )
+        $script = "$data\n$script";
+
+    $wp_scripts->add_data( 'customize-loader', 'data', $script );
+}
+add_action( 'admin_enqueue_scripts', '_wp_customize_loader_settings' );
 
 /**