Changeset 34903

Timestamp:

10/07/2015 10:35:18 AM (9 years ago)

Author:

pento

Message:

Embeds: Add oEmbed provider support.

For the past 6 years, WordPress has operated as an oEmbed consumer, allowing users to easily embed content from other sites. By adding oEmbed provider support, this allows any oEmbed consumer to embed posts from WordPress sites.

In addition to creating an oEmbed provider, WordPress' oEmbed consumer code has been enhanced to work with any site that provides oEmbed data (as long as it matches some strict security rules), and provides a preview from within the post editor.

For security, embeds appear within a sandboxed iframe - the iframe content is a template that can be styled or replaced entirely by the theme on the provider site.

Props swissspidy, pento, melchoyce, netweb, pfefferle, johnbillion, extendwings, davidbinda, danielbachhuber, SergeyBiryukov, afercia

Fixes #32522.

Location:

trunk

Files:

• Gruntfile.js (modified) (3 diffs)
• src/wp-includes/admin-bar.php (modified) (1 diff)
• src/wp-includes/class-wp-editor.php (modified) (1 diff)
• src/wp-includes/class-wp-embed.php (modified) (1 diff)
• src/wp-includes/class-wp-oembed-controller.php (added)
• src/wp-includes/class-wp-rewrite.php (modified) (7 diffs)
• src/wp-includes/class-wp.php (modified) (1 diff)
• src/wp-includes/css/wp-oembed-embed.css (added)
• src/wp-includes/default-filters.php (modified) (1 diff)
• src/wp-includes/embed-functions.php (modified) (1 diff)
• src/wp-includes/embed-template.php (added)
• src/wp-includes/js/tinymce/plugins/wpoembed (added)
• src/wp-includes/js/tinymce/plugins/wpoembed/plugin.js (added)
• src/wp-includes/js/wp-oembed-embed.js (added)
• src/wp-includes/js/wp-oembed.js (added)
• src/wp-includes/query.php (modified) (5 diffs)
• src/wp-includes/script-loader.php (modified) (1 diff)
• src/wp-includes/template-loader.php (modified) (1 diff)
• src/wp-settings.php (modified) (1 diff)
• tests/phpunit/multisite.xml (modified) (1 diff)
• tests/phpunit/tests/oembed (added)
• tests/phpunit/tests/oembed/controller.php (added)
• tests/phpunit/tests/oembed/discovery.php (added)
• tests/phpunit/tests/oembed/filterResult.php (added)
• tests/phpunit/tests/oembed/getResponseData.php (added)
• tests/phpunit/tests/oembed/headers.php (added)
• tests/phpunit/tests/oembed/postEmbedUrl.php (added)
• tests/phpunit/tests/oembed/template.php (added)

trunk/Gruntfile.js

@@ -233 +233 @@
 
                     // Exceptions
-                    '!wp-includes/css/dashicons.css'
+                    '!wp-includes/css/dashicons.css',
+                    '!wp-includes/css/wp-oembed-embed.css'
                 ]
             },
@@ -529 +530 @@
                 src: BUILD_DIR + 'wp-includes/formatting.php',
                 dest: '.'
+            },
+            oembed: {
+                src: BUILD_DIR + 'wp-includes/oembed-functions.php',
+                dest: '.'
             }
         },
@@ -638 +643 @@
         'concat:emoji',
         'includes:emoji',
+        'includes:oembed',
         'jsvalidate:build'
     ] );

trunk/src/wp-includes/admin-bar.php

@@ -899 +899 @@
         return false;
 
+    if ( is_embed() ) {
+        return false;
+    }
+
     // Integrated into the admin.
     if ( is_admin() )

trunk/src/wp-includes/class-wp-editor.php

@@ -402 +402 @@
                         'wpdialogs',
                         'wptextpattern',
-                        'wpview'
+                        'wpview',
+                        'wpoembed',
                     );
 

trunk/src/wp-includes/class-wp-embed.php

@@ -234 +234 @@
              *
              * @since 2.9.0
+             * @since 4.4.0 The default value changed to true.
              *
              * @see WP_oEmbed::discover()
              *
-             * @param bool $enable Whether to enable `<link>` tag discovery. Default false.
+             * @param bool $enable Whether to enable `<link>` tag discovery. Default true.
              */
-            $attr['discover'] = ( apply_filters( 'embed_oembed_discover', false ) && author_can( $post_ID, 'unfiltered_html' ) );
+            $attr['discover'] = ( apply_filters( 'embed_oembed_discover', true ) );
 
             // Use oEmbed to get the HTML

trunk/src/wp-includes/class-wp-rewrite.php

@@ -862 +862 @@
         $pageregex = $this->pagination_base . '/?([0-9]{1,})/?$';
         $commentregex = $this->comments_pagination_base . '-([0-9]{1,})/?$';
+        $embedregex = 'embed/?$';
 
         //build up an array of endpoint regexes to append => queries to append
@@ -885 +886 @@
         $feedindex = $index;
         $trackbackindex = $index;
+        $embedindex = $index;
+
         //build a list from the rewritecode and queryreplace arrays, that will look something like
         //tagname=$matches[i] where i is the current $i
@@ -1030 +1033 @@
                     $trackbackmatch = $match . $trackbackregex;
                     $trackbackquery = $trackbackindex . '?' . $query . '&tb=1';
+
+                    // Create query and regex for embeds.
+                    $embedmatch = $match . $embedregex;
+                    $embedquery = $embedindex . '?' . $query . '&embed=true';
+
                     //trim slashes from the end of the regex for this dir
                     $match = rtrim($match, '/');
+
                     //get rid of brackets
                     $submatchbase = str_replace( array('(', ')'), '', $match);
@@ -1041 +1050 @@
                     $sub1feed2 = $sub1 . $feedregex2; //and <permalink>/(feed|atom...)
                     $sub1comment = $sub1 . $commentregex; //and <permalink>/comment-page-xx
+                    $sub1embed = $sub1 . $embedregex; //and <permalink>/embed/...
 
                     //add another rule to match attachments in the explicit form:
@@ -1049 +1059 @@
                     $sub2feed2 = $sub2 . $feedregex2;  //and feeds again on to this <permalink>/attachment/(feed|atom...)
                     $sub2comment = $sub2 . $commentregex; //and <permalink>/comment-page-xx
+                    $sub2embed = $sub2 . $embedregex; //and <permalink>/embed/...
 
                     //create queries for these extra tag-ons we've just dealt with
@@ -1055 +1066 @@
                     $subfeedquery = $subquery . '&feed=' . $this->preg_index(2);
                     $subcommentquery = $subquery . '&cpage=' . $this->preg_index(2);
+                    $subembedquery = $subquery . '&embed=true';
 
                     //do endpoints for attachments
@@ -1093 +1105 @@
                     $rewrite = array_merge(array($trackbackmatch => $trackbackquery), $rewrite);
 
+                    // add embed
+                    $rewrite = array_merge( array( $embedmatch => $embedquery ), $rewrite );
+
                     //add regexes/queries for attachments, attachment trackbacks and so on
-                    if ( ! $page ) //require <permalink>/attachment/stuff form for pages because of confusion with subpages
-                        $rewrite = array_merge($rewrite, array($sub1 => $subquery, $sub1tb => $subtbquery, $sub1feed => $subfeedquery, $sub1feed2 => $subfeedquery, $sub1comment => $subcommentquery));
-                    $rewrite = array_merge(array($sub2 => $subquery, $sub2tb => $subtbquery, $sub2feed => $subfeedquery, $sub2feed2 => $subfeedquery, $sub2comment => $subcommentquery), $rewrite);
+                    if ( ! $page ) {
+                        //require <permalink>/attachment/stuff form for pages because of confusion with subpages
+                        $rewrite = array_merge( $rewrite, array($sub1 => $subquery, $sub1tb => $subtbquery, $sub1feed => $subfeedquery, $sub1feed2 => $subfeedquery, $sub1comment => $subcommentquery, $sub1embed => $subembedquery ) );
+                    }
+
+                    $rewrite = array_merge( array( $sub2 => $subquery, $sub2tb => $subtbquery, $sub2feed => $subfeedquery, $sub2feed2 => $subfeedquery, $sub2comment => $subcommentquery, $sub2embed => $subembedquery ), $rewrite );
                 }
             } //if($num_toks)

trunk/src/wp-includes/class-wp.php

@@ -16 +16 @@
      * @var array
      */
-    public $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'comments_popup', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'title');
+    public $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'comments_popup', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'title', 'embed', 'oembed', 'format', 'url', '_jsonp', 'maxwidth' );
 
     /**

trunk/src/wp-includes/default-filters.php

@@ -423 +423 @@
 add_filter( 'media_send_to_editor', 'image_media_send_to_editor', 10, 3 );
 
+// Embeds
+
+add_action( 'parse_query', 'wp_oembed_parse_query' );
+
+add_action( 'wp_head', 'wp_oembed_add_discovery_links' );
+add_action( 'wp_head', 'wp_oembed_add_host_js' );
+
+add_action( 'oembed_head', 'print_emoji_detection_script' );
+add_action( 'oembed_head', 'print_emoji_styles' );
+add_action( 'oembed_head', 'print_oembed_embed_styles' );
+add_action( 'oembed_head', 'print_oembed_embed_scripts' );
+add_action( 'oembed_head', 'wp_print_head_scripts', 20 );
+add_action( 'oembed_head', 'wp_print_styles', 20 );
+add_action( 'oembed_head', 'wp_no_robots' );
+add_action( 'oembed_head', 'rel_canonical' );
+add_action( 'oembed_head', 'locale_stylesheet' );
+
+add_action( 'oembed_footer', 'wp_print_footer_scripts', 20 );
+
+add_filter( 'excerpt_more', 'wp_oembed_excerpt_more', 20 );
+add_filter( 'the_excerpt_embed', 'wptexturize' );
+add_filter( 'the_excerpt_embed', 'convert_chars' );
+add_filter( 'the_excerpt_embed', 'wpautop' );
+add_filter( 'the_excerpt_embed', 'shortcode_unautop' );
+add_filter( 'the_excerpt_embed', 'wp_oembed_excerpt_attachment' );
+
+add_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10, 3 );
+add_filter( 'oembed_response_data', 'get_oembed_response_data_rich', 10, 4 );
+
 unset( $filter, $action );

trunk/src/wp-includes/embed-functions.php

@@ -327 +327 @@
     return apply_filters( 'wp_embed_handler_video', $video, $attr, $url, $rawattr );
 }
+
+/**
+ * Parse an oEmbed API query.
+ *
+ * @since 4.4.0
+ */
+function wp_oembed_parse_query( $wp_query ) {
+    $controller = new WP_oEmbed_Controller;
+    $controller->parse_query( $wp_query );
+}
+
+/**
+ * Adds oEmbed discovery links in the website <head>.
+ *
+ * @since 4.4.0
+ */
+function wp_oembed_add_discovery_links() {
+    $output = '';
+
+    if ( is_singular() ) {
+        $output .= '<link rel="alternate" type="application/json+oembed" href="' . esc_url( get_oembed_endpoint_url( get_permalink() ) ) . '" />' . "\n";
+        $output .= '<link rel="alternate" type="text/xml+oembed" href="' . esc_url( get_oembed_endpoint_url( get_permalink(), 'xml' ) ) . '" />' . "\n";
+    }
+
+    /**
+     * Filter the oEmbed discovery links.
+     *
+     * @since 4.4.0
+     *
+     * @param string $output HTML of the discovery links.
+     */
+    echo apply_filters( 'oembed_discovery_links', $output );
+}
+
+/**
+ * Add the necessary JavaScript to communicate with the embedded iframes.
+ *
+ * @since 4.4.0
+ */
+function wp_oembed_add_host_js() {
+    wp_enqueue_script( 'wp-oembed' );
+}
+
+
+/**
+ * Get the URL to embed a specific post in an iframe.
+ *
+ * @since 4.4.0
+ *
+ * @param int|WP_Post $post Optional. Post ID or object. Defaults to the current post.
+ * @return string|false The post embed URL on success, false if the post doesn't exist.
+ */
+function get_post_embed_url( $post = null ) {
+    $post = get_post( $post );
+
+    if ( ! $post ) {
+        return false;
+    }
+
+    if ( get_option( 'permalink_structure' ) ) {
+        $embed_url = trailingslashit( get_permalink( $post ) ) . user_trailingslashit( 'embed' );
+    } else {
+        $embed_url = add_query_arg( array( 'embed' => 'true' ), get_permalink( $post ) );
+    }
+
+    /**
+     * Filter the URL to embed a specific post.
+     *
+     * @since 4.4.0
+     *
+     * @param string  $embed_url The post embed URL.
+     * @param WP_Post $post      The corresponding post object.
+     */
+    return esc_url_raw( apply_filters( 'post_embed_url', $embed_url, $post ) );
+}
+
+/**
+ * Get the oEmbed endpoint URL for a given permalink.
+ *
+ * Pass an empty string as the first argument
+ * to get the endpoint base URL.
+ *
+ * @since 4.4.0
+ *
+ * @param string $permalink Optional. The permalink used for the `url` query arg. Default empty.
+ * @param string $format    Optional. The requested response format. Default 'json'.
+ * @return string The oEmbed endpoint URL.
+ */
+function get_oembed_endpoint_url( $permalink = '', $format = 'json' ) {
+    $url = add_query_arg( array( 'oembed' => 'true' ), home_url( '/' ) );
+
+    if ( 'json' === $format ) {
+        $format = false;
+    }
+
+    if ( '' !== $permalink ) {
+        $url = add_query_arg( array(
+            'url'    => $permalink,
+            'format' => $format,
+        ), $url );
+    }
+
+    /**
+     * Filter the oEmbed endpoint URL.
+     *
+     * @since 4.4.0
+     *
+     * @param string $url       The URL to the oEmbed endpoint.
+     * @param string $permalink The permalink used for the `url` query arg.
+     * @param string $format    The requested response format.
+     */
+    return apply_filters( 'oembed_endpoint_url', $url, $permalink, $format );
+}
+
+/**
+ * Get the embed code for a specific post.
+ *
+ * @since 4.4.0
+ *
+ * @param int|WP_Post $post   Optional. Post ID or object. Default is global `$post`.
+ * @param int         $width  The width for the response.
+ * @param int         $height The height for the response.
+ * @return string|false Embed code on success, false if post doesn't exist.
+ */
+function get_post_embed_html( $post = null, $width, $height ) {
+    $post = get_post( $post );
+
+    if ( ! $post ) {
+        return false;
+    }
+
+    $embed_url = get_post_embed_url( $post );
+
+    $output = "<script type='text/javascript'>\n";
+    if ( SCRIPT_DEBUG ) {
+        $output .= file_get_contents( ABSPATH . WPINC . '/js/wp-oembed.js' );
+    } else {
+        /*
+         * If you're looking at a src version of this file, you'll see an "include"
+         * statement below. This is used by the `grunt build` process to directly
+         * include a minified version of wp-oembed.js, instead of using the
+         * file_get_contents() method from above.
+         *
+         * If you're looking at a build version of this file, you'll see a string of
+         * minified JavaScript. If you need to debug it, please turn on SCRIPT_DEBUG
+         * and edit wp-oembed.js directly.
+         */
+        $output .=<<<JS
+        include "js/wp-oembed.min.js"
+JS;
+    }
+    $output .= "\n</script>";
+
+    $output .= sprintf(
+        '<iframe sandbox="allow-scripts" security="restricted" src="%1$s" width="%2$d" height="%3$d" title="%4$s" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe>',
+        esc_url( $embed_url ),
+        absint( $width ),
+        absint( $height ),
+        esc_attr__( 'Embedded WordPress Post', 'oembed-api' )
+    );
+
+    /**
+     * Filters the oEmbed HTML output.
+     *
+     * @since 4.4.0
+     *
+     * @param string  $output The default HTML.
+     * @param WP_Post $post   Current post object.
+     * @param int     $width  Width of the response.
+     * @param int     $height Height of the response.
+     */
+    return apply_filters( 'oembed_html', $output, $post, $width, $height );
+}
+
+/**
+ * Get the oEmbed response data for a given post.
+ *
+ * @since 4.4.0
+ *
+ * @param WP_Post|int $post  Optional. Post object or ID. Default is global `$post`.
+ * @param int         $width The requested width.
+ * @return array|false Response data on success, false if post doesn't exist.
+ */
+function get_oembed_response_data( $post = null, $width ) {
+    $post = get_post( $post );
+
+    if ( ! $post ) {
+        return false;
+    }
+
+    if ( 'publish' !== get_post_status( $post ) ) {
+        return false;
+    }
+
+    /**
+     * Filter the allowed minimum width for the oEmbed response.
+     *
+     * @param int $width The minimum width. Defaults to 200.
+     */
+    $minwidth = apply_filters( 'oembed_minwidth', 200 );
+
+    /**
+     * Filter the allowed maximum width for the oEmbed response.
+     *
+     * @param int $width The maximum width. Defaults to 600.
+     */
+    $maxwidth = apply_filters( 'oembed_maxwidth', 600 );
+
+    if ( $width < $minwidth ) {
+        $width = $minwidth;
+    } else if ( $width > $maxwidth ) {
+        $width = $maxwidth;
+    }
+
+    $height = ceil( $width / 16 * 9 );
+
+    if ( 200 > $height ) {
+        $height = 200;
+    }
+
+    $data = array(
+        'version'       => '1.0',
+        'provider_name' => get_bloginfo( 'name' ),
+        'provider_url'  => get_home_url(),
+        'author_name'   => get_bloginfo( 'name' ),
+        'author_url'    => get_home_url(),
+        'title'         => $post->post_title,
+        'type'          => 'link',
+    );
+
+    $author = get_userdata( $post->post_author );
+
+    if ( $author ) {
+        $data['author_name'] = $author->display_name;
+        $data['author_url']  = get_author_posts_url( $author->ID );
+    }
+
+    /**
+     * Filter the oEmbed response data.
+     *
+     * @since 4.4.0
+     *
+     * @param array   $data   The response data.
+     * @param WP_Post $post   The post object.
+     * @param int     $width  The requested width.
+     * @param int     $height The calculated height.
+     */
+    return apply_filters( 'oembed_response_data', $data, $post, $width, $height );
+}
+
+/**
+ * Filters the oEmbed response data to return an iframe embed code.
+ *
+ * @since 4.4.0
+ *
+ * @param array   $data   The response data.
+ * @param WP_Post $post   The post object.
+ * @param int     $width  The requested width.
+ * @param int     $height The calculated height.
+ * @return array The modified response data.
+ */
+function get_oembed_response_data_rich( $data, $post, $width, $height ) {
+    $data['width']  = absint( $width );
+    $data['height'] = absint( $height );
+    $data['type']   = 'rich';
+    $data['html']   = get_post_embed_html( $post, $width, $height );
+
+    // Add post thumbnail to response if available.
+    $thumbnail_id = false;
+
+    if ( has_post_thumbnail( $post->ID ) ) {
+        $thumbnail_id = get_post_thumbnail_id( $post->ID );
+    }
+
+    if ( 'attachment' === get_post_type( $post ) ) {
+        if ( wp_attachment_is_image( $post ) ) {
+            $thumbnail_id = $post->ID;
+        } else if ( wp_attachment_is( 'video', $post ) ) {
+            $thumbnail_id = get_post_thumbnail_id( $post );
+            $data['type'] = 'video';
+        }
+    }
+
+    if ( $thumbnail_id ) {
+        list( $thumbnail_url, $thumbnail_width, $thumbnail_height ) = wp_get_attachment_image_src( $thumbnail_id, array( $width, 99999 ) );
+        $data['thumbnail_url']    = $thumbnail_url;
+        $data['thumbnail_width']  = $thumbnail_width;
+        $data['thumbnail_height'] = $thumbnail_height;
+    }
+
+    return $data;
+}
+
+/**
+ * Ensures that the specified format is either 'json' or 'xml'.
+ *
+ * @since 4.4.0
+ *
+ * @param string $format The oEmbed response format. Accepts 'json', 'xml'.
+ * @return string The format, either 'xml' or 'json'. Default 'json'.
+ */
+function wp_oembed_ensure_format( $format ) {
+    if ( ! in_array( $format, array( 'json', 'xml' ), true ) ) {
+        return 'json';
+    }
+
+    return $format;
+}
+
+/**
+ * Creates an XML string from a given array.
+ *
+ * @since 4.4.0
+ * @access private
+ *
+ * @param array            $data The original oEmbed response data.
+ * @param SimpleXMLElement $node Optional. XML node to append the result to recursively.
+ * @return string|false XML string on success, false on error.
+ */
+function _oembed_create_xml( $data, $node = null ) {
+    if ( ! is_array( $data ) || empty( $data ) ) {
+        return false;
+    }
+
+    if ( null === $node ) {
+        $node = new SimpleXMLElement( '<oembed></oembed>' );
+    }
+
+    foreach ( $data as $key => $value ) {
+        if ( is_numeric( $key ) ) {
+            $key = 'oembed';
+        }
+
+        if ( is_array( $value ) ) {
+            $item = $node->addChild( $key );
+            _oembed_create_xml( $value, $item );
+        } else {
+            $node->addChild( $key, esc_html( $value ) );
+        }
+    }
+
+    return $node->asXML();
+}
+
+/**
+ * Filters the returned oEmbed HTML.
+ *
+ * If the $url isn't on the trusted providers list,
+ * we need to filter the HTML heavily for security.
+ *
+ * Only filters 'rich' and 'html' response types.
+ *
+ * @since 4.4.0
+ *
+ * @param string $return The returned oEmbed HTML.
+ * @param object $data   A data object result from an oEmbed provider.
+ * @param string $url    The URL of the content to be embedded.
+ * @return string The filtered and sanitized oEmbed result.
+ */
+function wp_filter_oembed_result( $return, $data, $url ) {
+    if ( false === $return || ! in_array( $data->type, array( 'rich', 'video' ) ) ) {
+        return $return;
+    }
+
+    require_once( ABSPATH . WPINC . '/class-oembed.php' );
+    $wp_oembed = _wp_oembed_get_object();
+
+    // Don't modify the HTML for trusted providers.
+    if ( false !== $wp_oembed->get_provider( $url, array( 'discover' => false ) ) ) {
+        return $return;
+    }
+
+    $allowed_html = array(
+        'iframe' => array(
+            'src'          => true,
+            'width'        => true,
+            'height'       => true,
+            'frameborder'  => true,
+            'marginwidth'  => true,
+            'marginheight' => true,
+            'scrolling'    => true,
+            'title'        => true,
+            'class'        => true,
+        ),
+    );
+
+    $html = wp_kses( $return, $allowed_html );
+    preg_match( '|^.*(<iframe.*?></iframe>).*$|m', $html, $iframes );
+
+    if ( empty( $iframes ) ) {
+        return false;
+    }
+
+    $html = str_replace( '<iframe', '<iframe sandbox="allow-scripts" security="restricted"', $iframes[1] );
+
+    preg_match( '/ src=[\'"]([^\'"]*)[\'"]/', $html, $results );
+
+    if ( ! empty( $results ) ) {
+        $secret = wp_generate_password( 10, false );
+
+        $url = esc_url( "{$results[1]}#?secret=$secret" );
+
+        $html = str_replace( $results[0], " src=\"$url\" data-secret=\"$secret\"", $html );
+    }
+
+    return $html;
+}
+
+/**
+ * Filters the string in the "more" link displayed after a trimmed excerpt.
+ *
+ * @since 4.4.0
+ *
+ * @param string $more_string The string shown within the more link.
+ * @return string The modified excerpt.
+ */
+function wp_oembed_excerpt_more( $more_string ) {
+    if ( ! is_embed() ) {
+        return $more_string;
+    }
+
+    return sprintf(
+        _x( '&hellip; %s', 'read more link', 'oembed-api' ),
+        sprintf(
+            '<a class="wp-embed-more" href="%s" target="_top">%s</a>',
+            get_the_permalink(),
+            __( 'Read more', 'oembed-api' )
+        )
+    );
+}
+
+/**
+ * Display the post excerpt for the embed template.
+ *
+ * @since 4.4.0
+ */
+function the_excerpt_embed() {
+    $output = get_the_excerpt();
+
+    /**
+     * Filter the post excerpt for the embed template.
+     *
+     * @param string $output The current post excerpt.
+     */
+    echo apply_filters( 'the_excerpt_embed', $output );
+}
+
+/**
+ * Filters the post excerpt for the embed template.
+ *
+ * Shows players for video and audio attachments.
+ *
+ * @since 4.4.0
+ *
+ * @param string $content The current post excerpt.
+ * @return string The modified post excerpt.
+ */
+function wp_oembed_excerpt_attachment( $content ) {
+    if ( is_attachment() ) {
+        return prepend_attachment( '' );
+    }
+
+    return $content;
+}
+
+/**
+ * Print the CSS in the embed iframe header.
+ *
+ * @since 4.4.0
+ */
+function print_oembed_embed_styles() {
+    ?>
+    <style type="text/css">
+    <?php
+        if ( WP_DEBUG ) {
+            readfile( ABSPATH . WPINC . "/css/wp-oembed-embed.css" );
+        } else {
+            /*
+             * If you're looking at a src version of this file, you'll see an "include"
+             * statement below. This is used by the `grunt build` process to directly
+             * include a minified version of wp-oembed-embed.css, instead of using the
+             * readfile() method from above.
+             *
+             * If you're looking at a build version of this file, you'll see a string of
+             * minified CSS. If you need to debug it, please turn on WP_DEBUG
+             * and edit wp-oembed-embed.css directly.
+             */
+            ?>
+            include "css/wp-oembed-embed.min.css"
+            <?php
+        }
+    ?>
+    </style>
+    <?php
+}
+
+/**
+ * Print the CSS in the embed iframe header.
+ *
+ * @since 4.4.0
+ */
+function print_oembed_embed_scripts() {
+    ?>
+    <script type="text/javascript">
+    <?php
+        if ( SCRIPT_DEBUG ) {
+            readfile( ABSPATH . WPINC . "/js/wp-oembed-embed.js" );
+        } else {
+            /*
+             * If you're looking at a src version of this file, you'll see an "include"
+             * statement below. This is used by the `grunt build` process to directly
+             * include a minified version of wp-oembed-embed.js, instead of using the
+             * readfile() method from above.
+             *
+             * If you're looking at a build version of this file, you'll see a string of
+             * minified JavaScript. If you need to debug it, please turn on SCRIPT_DEBUG
+             * and edit wp-oembed-embed.js directly.
+             */
+            ?>
+            include "js/wp-oembed-embed.min.js"
+            <?php
+        }
+    ?>
+    </script>
+    <?php
+}

trunk/src/wp-includes/query.php

@@ -717 +717 @@
 
     return $wp_query->is_404();
+}
+
+/**
+ * Is the query for an embedded post?
+ *
+ * @since 4.4.0
+ *
+ * @global WP_Query $wp_query Global WP_Query instance.
+ *
+ * @return bool Whether we're in an embedded post or not.
+ */
+function is_embed() {
+    global $wp_query;
+
+    if ( ! isset( $wp_query ) ) {
+        _doing_it_wrong( __FUNCTION__, __( 'Conditional query tags do not work before the query is run. Before then, they always return false.' ), '3.1' );
+        return false;
+    }
+
+    return $wp_query->is_embed();
 }
 
@@ -1200 +1220 @@
      */
     public $is_404 = false;
+
+    /**
+     * Set if query is embed.
+     *
+     * @since 4.4.0
+     * @access public
+     * @var bool
+     */
+    public $is_embed = false;
 
     /**
@@ -1846 +1875 @@
             $this->set_404();
 
+        $this->is_embed = isset( $qv['embed'] ) && ( $this->is_singular || $this->is_404 );
+
         $this->query_vars_hash = md5( serialize( $this->query_vars ) );
         $this->query_vars_changed = false;
@@ -4636 +4667 @@
 
     /**
+     * Is the query for an embedded post?
+     *
+     * @since 3.1.0
+     *
+     * @return bool
+     */
+    public function is_embed() {
+        return (bool) $this->is_embed;
+    }
+
+    /**
      * Is the query the main query?
      *
@@ -4936 +4978 @@
         } elseif ( isset( $GLOBALS['wp_query']->query_vars['paged'] ) && $GLOBALS['wp_query']->query_vars['paged'] > 1 ) {
             $link = user_trailingslashit( trailingslashit( $link ) . 'page/' . $GLOBALS['wp_query']->query_vars['paged'] );
+        } elseif( is_embed() ) {
+            $link = user_trailingslashit( trailingslashit( $link ) . 'embed' );
         } elseif ( is_404() ) {
             // Add rewrite endpoints if necessary.

trunk/src/wp-includes/script-loader.php

@@ -467 +467 @@
     ) );
 
+    $scripts->add( 'wp-oembed', "/wp-includes/js/wp-oembed$suffix.js" );
+
     // To enqueue media-views or media-editor, call wp_enqueue_media().
     // Both rely on numerous settings, styles, and templates to operate correctly.

trunk/src/wp-includes/template-loader.php

@@ -40 +40 @@
     include( ABSPATH . 'wp-trackback.php' );
     return;
+elseif ( is_embed() ) :
+    $template = ABSPATH . WPINC . '/embed-template.php';
+
+    /**
+     * Filter the template used for embedded posts.
+     *
+     * @since 4.4.0
+     *
+     * @param string $template Path to the template file.
+     */
+    $template = apply_filters( 'embed_template', $template );
+
+    include ( $template );
+    return;
 endif;
 

trunk/src/wp-settings.php

@@ -148 +148 @@
 require( ABSPATH . WPINC . '/class-wp-embed.php' );
 require( ABSPATH . WPINC . '/embed-functions.php' );
+require( ABSPATH . WPINC . '/class-wp-oembed-controller.php' );
 require( ABSPATH . WPINC . '/media.php' );
 require( ABSPATH . WPINC . '/http.php' );

trunk/tests/phpunit/multisite.xml

@@ -26 +26 @@
             <group>ms-files</group>
             <group>external-http</group>
+            <group>oembed-headers</group>
         </exclude>
     </groups>