![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 7 years ago
Last modified 4 months ago
#48656 new defect (bug)
Views details blocked by SAMEORIGIN
| Reported by: | sebastienserre | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Plugins | Version: | 5.3 |
| Severity: | major | Keywords: | has-patch |
| Cc: | Focuses: | multisite |
Description
Hello,
On multisite, the "view detail" link on this page /wp-admin/plugins.php (in each plugin) is bloked by an error
Chargement refusé par X-Frame-Options : « SAMEORIGIN » à l’adresse « https://example.com/wp-admin/network/plugin-install.php?tab=plugin-information&plugin=loco-translate& », le site ne permet pas l’utilisation de cadres multiorigines depuis « https://example.com/wp-admin/plugins.php ».
Attachments (1)
Change History (5)
#3
@
7 years ago
- Severity normal → major
- Version → 5.3
Errors in English, in Firefox 70.0.1 for Linux Web Console:
Load denied by X-Frame-Options: “SAMEORIGIN” from “https://example.com/wp-admin/network/plugin-install.php?tab=plugin-information&plugin=contact-form-7&”, site does not permit cross-origin framing from “https://example.com/wp-admin/plugins.php”.
SecurityError: Permission denied to access property "document" on cross-origin object
@
4 months ago
Skip the network admin redirect in plugin-install.php when handling an IFRAME_REQUEST (plugin information modal). This prevents the cross-origin X-Frame-Options SAMEORIGIN block that occurs on multisite subsites when clicking "View Details" on a plugin.
#4
@
4 months ago
- Keywords has-patch added; needs-patch removed
The issue is in plugin-install.php. On multisite subsites, the redirect to network_admin_url() on line 22 fires even for IFRAME_REQUEST (the "View Details" thickbox modal). This causes a cross-origin redirect, which the browser blocks due to X-Frame-Options: SAMEORIGIN.
The patch skips the network admin redirect when IFRAME_REQUEST is defined, so the plugin information modal loads directly on the subsite without a cross-origin issue. IFRAME_REQUEST is already set on line 9 when tab=plugin-information.
This happened only on a subsite, not on the main network level.