Changeset 35640

Timestamp:

11/16/2015 12:22:16 AM (9 years ago)

Author:

pento

Message:

Embeds: Add the allow_insecure_embeds filter.

This allows a site to disable non-SSL embeds.

Fixes #34588.

File:

• trunk/src/wp-includes/class-wp-embed.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-embed.php

@@ -142 +142 @@
             $this->last_attr = $attr;
             return '';
+        }
+
+        /**
+         * Optionally allow or block non-SSL embeds.
+         *
+         * @since 4.4.0
+         *
+         * @param bool   $allowed Flag to determine if non-SSL embeds should be allowed. Default true.
+         * @param string $url     The URL being embedded.
+         */
+        if ( 0 !== strpos( $url, 'https://' ) && ! apply_filters( 'allow_insecure_embeds', true, $url ) ) {
+            return false;
         }