WP Importer blank due to X-Frame Options

[GaryJ]

WP 3.2, Chrome 12 on Win7.

When trying to add the WordPress Importer, the thickbox is coming up blank - Chrome console gives the error as:

Refused to display document because display forbidden by X-Frame-Options.

In short, the importer can't be installed by the usual method.

Probably related: #12293

[nacin]

You have some odd domain mapping or URL-changing settings enabled?

[GaryJ]

I've got WP MS running - due to the way Plesk on my host works, I have to run what would usually be a wildcard subdomain as a domain alias instead, but I've done that for other WP MS installs pre-3.2, and never had an issue with getting the Importer installed that I remember.

Saying that, the thickbox does appear populated when trying to install the Importer from the root network site.

[nacin]

So, we decided to go with X-Frame-Options: SAMEORIGIN without any special handling, rather than DENY with handling to avoid IFRAME_REQUEST pages.

I think an exception for IFRAME_REQUEST wouldn't be a bad idea, considering how many people use various forms of domain mapping. That said, this is a very very edge case.

[trepmal]

I'm running into the same problem as GaryJ

I'm using MediaTemple's (ve) service which as far as I can tell requires the ServerAlias method to get wildcard subdomains to work. However, I'm by no means a server guru, so I may very well have set up something incorrectly.

[duck_]

Replying to nacin:

I think an exception for IFRAME_REQUEST wouldn't be a bad idea, considering how many people use various forms of domain mapping. That said, this is a very very edge case.

We don't want to exempt IFRAME_REQUEST for security reasons.

This isn't limited to domain mapping, but also occurs on subdomain setups when trying to install from off of the main site.

Should probably run a check to prevent installation and do something different on multisite when not on the main site.

[nacin]

Should probably run a check to prevent installation and do something different on multisite when not on the main site.

Yep.

[duck_]

In [18535]:

Direct a user to the main site to install importers, fixes #17990

[duck_]

Reopening for 3.2.2 consideration.