Changeset 31885

Timestamp:

03/25/2015 05:25:01 PM (10 years ago)

Author:

ocean90

Message:

Customizer: Avoid SecurityErrors when the Customizer is embedded in an origin other than wp-admin.

props mattwiebe.
fixes #31687.

Location:

trunk/src

Files:

• wp-admin/js/customize-controls.js (modified) (3 diffs)
• wp-includes/js/customize-loader.js (modified) (1 diff)

trunk/src/wp-admin/js/customize-controls.js

@@ -1930 +1930 @@
             this.query = $.extend( params.query || {}, { customize_messenger_channel: this.channel() });
 
+            // This avoids SecurityErrors when setting a window object in x-origin iframe'd scenarios.
+            this.targetWindow.set = function( to ) {
+                var from = this._value;
+
+                to = this._setter.apply( this, arguments );
+                to = this.validate( to );
+
+                if ( null === to || from === to ) {
+                    return this;
+                }
+
+                this._value = to;
+                this._dirty = true;
+
+                this.callbacks.fireWith( this, [ to, from ] );
+
+                return this;
+            };
+
             this.run( deferred );
         },
@@ -2119 +2138 @@
         title = tmpl.replace( '%s', documentTitle );
         document.title = title;
-        if ( window !== window.parent ) {
-            window.parent.document.title = document.title;
-        }
+        api.trigger( 'title', title );
     };
 
@@ -2800 +2817 @@
         });
 
+        // Pass titles to the parent
+        api.bind( 'title', function( newTitle ) {
+            parent.send( 'title', newTitle );
+        });
+
         // Initialize the connection with the parent frame.
         parent.send( 'ready' );

trunk/src/wp-includes/js/customize-loader.js

@@ -156 +156 @@
             } );
 
+            this.messenger.bind( 'title', function( newTitle ){
+                window.document.title = newTitle;
+            });
+
             this.pushState( src );