Changeset 61947

Timestamp:

03/11/2026 11:38:35 PM (2 months ago)

Author:

adamsilverstein

Message:

Editor: Skip cross-origin isolation for third-party page builders.

Document-Isolation-Policy (DIP) isolates the document and blocks same-origin iframe access that page builders rely on. Skip DIP setup when a third-party page builder overrides the block editor via a custom action query parameter.

Also gates wp_is_client_side_media_processing_enabled() on a secure context check, since SharedArrayBuffer requires a secure context (HTTPS or localhost).

Props adamsilverstein, westonruter, mukesh27, louiswol94, manhar, illuminea.
Fixes #64803.

Location:

trunk

Files:

• src/wp-includes/media.php (modified) (5 diffs)
• tests/phpunit/tests/media/wpCrossOriginIsolation.php (modified) (4 diffs)
• tests/phpunit/tests/rest-api/rest-attachments-controller.php (modified) (5 diffs)
• tests/phpunit/tests/rest-api/rest-schema-setup.php (modified) (1 diff)

trunk/src/wp-includes/media.php

@@ -6412 +6412 @@
  */
 function wp_is_client_side_media_processing_enabled(): bool {
+    // This is due to SharedArrayBuffer requiring a secure context.
+    $host    = strtolower( (string) strtok( $_SERVER['HTTP_HOST'] ?? '', ':' ) );
+    $enabled = ( is_ssl() || 'localhost' === $host || str_ends_with( $host, '.localhost' ) );
+
     /**
      * Filters whether client-side media processing is enabled.
@@ -6417 +6421 @@
      * @since 7.0.0
      *
-     * @param bool $enabled Whether client-side media processing is enabled. Default true.
-     */
-    return (bool) apply_filters( 'wp_client_side_media_processing_enabled', true );
+     * @param bool $enabled Whether client-side media processing is enabled. Default true if the page is served in a secure context.
+     */
+    return (bool) apply_filters( 'wp_client_side_media_processing_enabled', $enabled );
 }
 
@@ -6432 +6436 @@
     }
 
-    wp_add_inline_script( 'wp-block-editor', 'window.__clientSideMediaProcessing = true', 'before' );
+    wp_add_inline_script( 'wp-block-editor', 'window.__clientSideMediaProcessing = true;', 'before' );
 
     $chromium_version = wp_get_chromium_major_version();
@@ -6478 +6482 @@
  * on supported browsers (Chromium 137+).
  *
+ * Skips setup when a third-party page builder overrides the block
+ * editor via a custom `action` query parameter, as DIP would block
+ * same-origin iframe access that these editors rely on.
+ *
  * @since 7.0.0
  */
@@ -6492 +6500 @@
 
     if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
+        return;
+    }
+
+    /*
+     * Skip when a third-party page builder overrides the block editor.
+     * DIP isolates the document into its own agent cluster,
+     * which blocks same-origin iframe access that these editors rely on.
+     */
+    if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
         return;
     }

trunk/tests/phpunit/tests/media/wpCrossOriginIsolation.php

@@ -7 +7 @@
  * @covers ::wp_set_up_cross_origin_isolation
  * @covers ::wp_start_cross_origin_isolation_output_buffer
+ * @covers ::wp_is_client_side_media_processing_enabled
  */
 class Tests_Media_wpCrossOriginIsolation extends WP_UnitTestCase {
@@ -12 +13 @@
     /**
      * Original HTTP_USER_AGENT value.
-     *
-     * @var string|null
-     */
-    private $original_user_agent;
+     */
+    private ?string $original_user_agent;
+
+    /**
+     * Original HTTP_HOST value.
+     */
+    private ?string $original_http_host;
+
+    /**
+     * Original HTTPS value.
+     */
+    private ?string $original_https;
+
+    /**
+     * Original $_GET['action'] value.
+     */
+    private ?string $original_get_action;
 
     public function set_up() {
         parent::set_up();
-        $this->original_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : null;
+        $this->original_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? null;
+        $this->original_http_host  = $_SERVER['HTTP_HOST'] ?? null;
+        $this->original_https      = $_SERVER['HTTPS'] ?? null;
+        $this->original_get_action = $_GET['action'] ?? null;
     }
 
@@ -29 +46 @@
         }
 
+        if ( null === $this->original_http_host ) {
+            unset( $_SERVER['HTTP_HOST'] );
+        } else {
+            $_SERVER['HTTP_HOST'] = $this->original_http_host;
+        }
+
+        if ( null === $this->original_https ) {
+            unset( $_SERVER['HTTPS'] );
+        } else {
+            $_SERVER['HTTPS'] = $this->original_https;
+        }
+
+        if ( null === $this->original_get_action ) {
+            unset( $_GET['action'] );
+        } else {
+            $_GET['action'] = $this->original_get_action;
+        }
+
         // Clean up any output buffers started during tests.
         while ( ob_get_level() > 1 ) {
@@ -126 +161 @@
 
     /**
+     * @ticket 64803
+     */
+    public function test_client_side_processing_disabled_on_non_secure_origin() {
+        $_SERVER['HTTP_HOST'] = 'example.com';
+        $_SERVER['HTTPS']     = '';
+
+        $this->assertFalse(
+            wp_is_client_side_media_processing_enabled(),
+            'Client-side media processing should be disabled on non-secure, non-localhost origins.'
+        );
+    }
+
+    /**
+     * @ticket 64803
+     */
+    public function test_client_side_processing_enabled_on_localhost() {
+        $_SERVER['HTTP_HOST'] = 'localhost';
+        $_SERVER['HTTPS']     = '';
+
+        $this->assertTrue(
+            wp_is_client_side_media_processing_enabled(),
+            'Client-side media processing should be enabled on localhost.'
+        );
+    }
+
+    /**
      * This test must run in a separate process because the output buffer
      * callback sends HTTP headers via header(), which would fail in the

trunk/tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -3163 +3163 @@
      */
     public function test_sideload_scaled_image() {
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
+        // Reinitialize REST server so the sideload route is registered.
+        global $wp_rest_server;
+        $wp_rest_server = new Spy_REST_Server();
+        do_action( 'rest_api_init', $wp_rest_server );
+
         wp_set_current_user( self::$author_id );
 
@@ -3216 +3222 @@
      */
     public function test_sideload_scaled_image_requires_auth() {
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
+        // Reinitialize REST server so the sideload route is registered.
+        global $wp_rest_server;
+        $wp_rest_server = new Spy_REST_Server();
+        do_action( 'rest_api_init', $wp_rest_server );
+
         wp_set_current_user( self::$author_id );
 
@@ -3245 +3257 @@
      */
     public function test_sideload_route_includes_scaled_enum() {
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
+        // Reinitialize REST server so the sideload route is registered.
+        global $wp_rest_server;
+        $wp_rest_server = new Spy_REST_Server();
+        do_action( 'rest_api_init', $wp_rest_server );
+
         $server = rest_get_server();
         $routes = $server->get_routes();
@@ -3267 +3285 @@
      */
     public function test_sideload_scaled_unique_filename() {
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
+        // Reinitialize REST server so the sideload route is registered.
+        global $wp_rest_server;
+        $wp_rest_server = new Spy_REST_Server();
+        do_action( 'rest_api_init', $wp_rest_server );
+
         wp_set_current_user( self::$author_id );
 
@@ -3301 +3325 @@
      */
     public function test_sideload_scaled_unique_filename_conflict() {
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
+        // Reinitialize REST server so the sideload route is registered.
+        global $wp_rest_server;
+        $wp_rest_server = new Spy_REST_Server();
+        do_action( 'rest_api_init', $wp_rest_server );
+
         wp_set_current_user( self::$author_id );
 

trunk/tests/phpunit/tests/rest-api/rest-schema-setup.php

@@ -16 +16 @@
     public function set_up() {
         parent::set_up();
+
+        // Ensure client-side media processing is enabled so the sideload route is registered.
+        add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
 
         /** @var WP_REST_Server $wp_rest_server */