vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-07 09:49:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

API for allowing cross origin resource sharing.

Browse Source 
* Allowed origin whitelist that can be altered by plugins
* Validation of the request origin against the whitelist
* Send Access-Control-Allow-Origin if origin allowed
* get_http_origin(), get_allowed_http_origins(), is_allowed_http_origin(), send_origin_headers()

See #20681



git-svn-id: https://develop.svn.wordpress.org/trunk@20794 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren
2012-05-15 18:46:03 +00:00
parent b5156f1b47
commit 4e1861e2a8
2 changed files with 78 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
wp-includes/class-wp-customize.php
View File

@@ -71,17 +71,7 @@ final class WP_Customize {
if ( ! isset( $_REQUEST['customize'] ) || 'on' != $_REQUEST['customize'] )
return;
$url = parse_url( admin_url() );
$allowed_origins = array( 'http://' . $url[ 'host' ], 'https://' . $url[ 'host' ] );
// @todo preserve port?
if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
$origin = $_SERVER[ 'HTTP_ORIGIN' ];
} else {
$origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
}
@header( 'Access-Control-Allow-Origin: ' . $origin );
@header( 'Access-Control-Allow-Credentials: true' );
send_origin_headers();
$this->start_previewing_theme();
show_admin_bar( false );