Changeset 62081 for trunk/src/wp-includes/media-template.php
- Timestamp:
- 03/20/2026 05:09:14 PM (3 months ago)
- File:
-
- 1 edited
-
trunk/src/wp-includes/media-template.php (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-includes/media-template.php
r61757 r62081 157 157 $class = 'media-modal wp-core-ui'; 158 158 159 $is_cross_origin_isolation_enabled = wp_is_client_side_media_processing_enabled();160 161 if ( $is_cross_origin_isolation_enabled ) {162 ob_start();163 }164 165 159 $alt_text_description = sprintf( 166 160 /* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */ … … 1589 1583 */ 1590 1584 do_action( 'print_media_templates' ); 1591 1592 if ( $is_cross_origin_isolation_enabled ) {1593 $html = (string) ob_get_clean();1594 1595 /*1596 * The media templates are inside <script type="text/html"> tags,1597 * whose content is treated as raw text by the HTML Tag Processor.1598 * Extract each script block's content, process it separately,1599 * then reassemble the full output.1600 */1601 $script_processor = new WP_HTML_Tag_Processor( $html );1602 while ( $script_processor->next_tag( 'SCRIPT' ) ) {1603 if ( 'text/html' !== $script_processor->get_attribute( 'type' ) ) {1604 continue;1605 }1606 /*1607 * Unlike wp_add_crossorigin_attributes(), this does not check whether1608 * URLs are actually cross-origin. Media templates use Underscore.js1609 * template expressions (e.g. {{ data.url }}) as placeholder URLs,1610 * so actual URLs are not available at parse time.1611 * The crossorigin attribute is added unconditionally to all relevant1612 * media tags to ensure cross-origin isolation works regardless of1613 * the final URL value at render time.1614 */1615 $template_processor = new WP_HTML_Tag_Processor( $script_processor->get_modifiable_text() );1616 while ( $template_processor->next_tag() ) {1617 if (1618 in_array( $template_processor->get_tag(), array( 'AUDIO', 'IMG', 'VIDEO' ), true )1619 && ! is_string( $template_processor->get_attribute( 'crossorigin' ) )1620 ) {1621 $template_processor->set_attribute( 'crossorigin', 'anonymous' );1622 }1623 }1624 $script_processor->set_modifiable_text( $template_processor->get_updated_html() );1625 }1626 1627 echo $script_processor->get_updated_html();1628 }1629 1585 }
Note: See TracChangeset
for help on using the changeset viewer.