Changeset 38890

Timestamp:

10/24/2016 08:06:06 PM (10 years ago)

Author:

westonruter

Message:

Customize: Harden url matching to account for varying ports and ensuring matching base pathname for allowed urls

Fixes #38409.

Location:

trunk/src

Files:

• wp-admin/js/customize-controls.js (modified) (2 diffs)
• wp-includes/js/customize-base.js (modified) (1 diff)
• wp-includes/js/customize-preview.js (modified) (6 diffs)

trunk/src/wp-admin/js/customize-controls.js

@@ -4041 +4041 @@
 
                         previewer.add( 'previewUrl', params.previewUrl ).setter( function( to ) {
-                                var result, urlParser, newPreviewUrl, schemeMatchingPreviewUrl, queryParams;
+                                var result = null, urlParser, queryParams, parsedAllowedUrl, parsedCandidateUrls = [];
                                 urlParser = document.createElement( 'a' );
                                 urlParser.href = to;
@@ -4063 +4063 @@
                                 }
 
-                                newPreviewUrl = urlParser.href;
-                                urlParser.protocol = previewer.scheme.get() + ':';
-                                schemeMatchingPreviewUrl = urlParser.href;
+                                parsedCandidateUrls.push( urlParser );
+
+                                // Prepend list with URL that matches the scheme/protocol of the iframe.
+                                if ( previewer.scheme.get() + ':' !== urlParser.protocol ) {
+                                        urlParser = document.createElement( 'a' );
+                                        urlParser.href = parsedCandidateUrls[0].href;
+                                        urlParser.protocol = previewer.scheme.get() + ':';
+                                        parsedCandidateUrls.unshift( urlParser );
+                                }
 
                                 // Attempt to match the URL to the control frame's scheme
                                 // and check if it's allowed. If not, try the original URL.
-                                $.each( [ schemeMatchingPreviewUrl, newPreviewUrl ], function( i, url ) {
-                                        $.each( previewer.allowedUrls, function( i, allowed ) {
-                                                var path;
-
-                                                allowed = allowed.replace( /\/+$/, '' );
-                                                path = url.replace( allowed, '' );
-
-                                                if ( 0 === url.indexOf( allowed ) && /^([/#?]|$)/.test( path ) ) {
-                                                        result = url;
-                                                        return false;
+                                parsedAllowedUrl = document.createElement( 'a' );
+                                _.find( parsedCandidateUrls, function( parsedCandidateUrl ) {
+                                        return ! _.isUndefined( _.find( previewer.allowedUrls, function( allowedUrl ) {
+                                                parsedAllowedUrl.href = allowedUrl;
+                                                if ( urlParser.protocol === parsedAllowedUrl.protocol && urlParser.host === parsedAllowedUrl.host && 0 === parsedAllowedUrl.pathname.indexOf( urlParser.pathname ) ) {
+                                                        result = parsedCandidateUrl.href;
+                                                        return true;
                                                 }
-                                        });
-                                        if ( result ) {
-                                                return false;
-                                        }
-                                });
-
-                                // If we found a matching result, return it. If not, bail.
-                                return result ? result : null;
+                                        } ) );
+                                } );
+
+                                return result;
                         });
 

trunk/src/wp-includes/js/customize-base.js

@@ -655 +655 @@
                                 var urlParser = document.createElement( 'a' );
                                 urlParser.href = to;
-                                return urlParser.protocol + '//' + urlParser.hostname;
+                                // Port stripping needed by IE since it adds to host but not to event.origin.
+                                return urlParser.protocol + '//' + urlParser.host.replace( /:80$/, '' );
                         });
 

trunk/src/wp-includes/js/customize-preview.js

@@ -276 +276 @@
          * @param {string} element.search Query string.
          * @param {string} element.pathname Path.
-         * @param {string} element.hostname Hostname.
+         * @param {string} element.host Host.
          * @param {object} [options]
          * @param {object} [options.allowAdminAjax=false] Allow admin-ajax.php requests.
@@ -282 +282 @@
          */
         api.isLinkPreviewable = function isLinkPreviewable( element, options ) {
-                var hasMatchingHost, urlParser, args;
+                var matchesAllowedUrl, parsedAllowedUrl, args;
 
                 args = _.extend( {}, { allowAdminAjax: false }, options || {} );
@@ -295 +295 @@
                 }
 
-                urlParser = document.createElement( 'a' );
-                hasMatchingHost = ! _.isUndefined( _.find( api.settings.url.allowed, function( allowedUrl ) {
-                        urlParser.href = allowedUrl;
-                        if ( urlParser.hostname === element.hostname && urlParser.protocol === element.protocol ) {
-                                return true;
-                        }
-                        return false;
+                parsedAllowedUrl = document.createElement( 'a' );
+                matchesAllowedUrl = ! _.isUndefined( _.find( api.settings.url.allowed, function( allowedUrl ) {
+                        parsedAllowedUrl.href = allowedUrl;
+                        return parsedAllowedUrl.protocol === element.protocol && parsedAllowedUrl.host === element.host && 0 === element.pathname.indexOf( parsedAllowedUrl.pathname );
                 } ) );
-                if ( ! hasMatchingHost ) {
+                if ( ! matchesAllowedUrl ) {
                         return false;
                 }
@@ -332 +329 @@
          *
          * @param {HTMLAnchorElement|HTMLAreaElement} element Link element.
-         * @param {object} element.search Query string.
+         * @param {string} element.search Query string.
+         * @param {string} element.host Host.
+         * @param {string} element.protocol Protocol.
          * @returns {void}
          */
@@ -349 +348 @@
 
                 // Make sure links in preview use HTTPS if parent frame uses HTTPS.
-                if ( 'https' === api.preview.scheme.get() && 'http:' === element.protocol && -1 !== api.settings.url.allowedHosts.indexOf( element.hostname ) ) {
+                if ( 'https' === api.preview.scheme.get() && 'http:' === element.protocol && -1 !== api.settings.url.allowedHosts.indexOf( element.host ) ) {
                         element.protocol = 'https:';
                 }
@@ -497 +496 @@
 
                 // Make sure forms in preview use HTTPS if parent frame uses HTTPS.
-                if ( 'https' === api.preview.scheme.get() && 'http:' === urlParser.protocol && -1 !== api.settings.url.allowedHosts.indexOf( urlParser.hostname ) ) {
+                if ( 'https' === api.preview.scheme.get() && 'http:' === urlParser.protocol && -1 !== api.settings.url.allowedHosts.indexOf( urlParser.host ) ) {
                         urlParser.protocol = 'https:';
                         form.action = urlParser.href;