Changeset 31885

Timestamp:

03/25/2015 05:25:01 PM (12 years ago)

Author:

ocean90

Message:

Customizer: Avoid SecurityErrors when the Customizer is embedded in an origin other than wp-admin.

props mattwiebe.
fixes #31687.

Location:

trunk/src

Files:

• wp-admin/js/customize-controls.js (modified) (3 diffs)
• wp-includes/js/customize-loader.js (modified) (1 diff)

trunk/src/wp-admin/js/customize-controls.js

@@ -1930 +1930 @@
                         this.query = $.extend( params.query || {}, { customize_messenger_channel: this.channel() });
 
+                        // This avoids SecurityErrors when setting a window object in x-origin iframe'd scenarios.
+                        this.targetWindow.set = function( to ) {
+                                var from = this._value;
+
+                                to = this._setter.apply( this, arguments );
+                                to = this.validate( to );
+
+                                if ( null === to || from === to ) {
+                                        return this;
+                                }
+
+                                this._value = to;
+                                this._dirty = true;
+
+                                this.callbacks.fireWith( this, [ to, from ] );
+
+                                return this;
+                        };
+
                         this.run( deferred );
                 },
@@ -2119 +2138 @@
                 title = tmpl.replace( '%s', documentTitle );
                 document.title = title;
-                if ( window !== window.parent ) {
-                        window.parent.document.title = document.title;
-                }
+                api.trigger( 'title', title );
         };
 
@@ -2800 +2817 @@
                 });
 
+                // Pass titles to the parent
+                api.bind( 'title', function( newTitle ) {
+                        parent.send( 'title', newTitle );
+                });
+
                 // Initialize the connection with the parent frame.
                 parent.send( 'ready' );

trunk/src/wp-includes/js/customize-loader.js

@@ -156 +156 @@
                         } );
 
+                        this.messenger.bind( 'title', function( newTitle ){
+                                window.document.title = newTitle;
+                        });
+
                         this.pushState( src );