From 50f7313fddc801d44e8dd453c2f753df1077799a Mon Sep 17 00:00:00 2001 From: Andrew Ozz Date: Thu, 17 Jul 2014 00:49:11 +0000 Subject: [PATCH] TinyMCE wpView: prevent fatal (security) errors when trying to access iframe.contentWindow in pausePlayers() and unsetPlayers(). See #28905. git-svn-id: https://develop.svn.wordpress.org/trunk@29202 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/js/mce-view.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/wp-includes/js/mce-view.js b/src/wp-includes/js/mce-view.js index 9217b30373..56a858307a 100644 --- a/src/wp-includes/js/mce-view.js +++ b/src/wp-includes/js/mce-view.js @@ -132,6 +132,7 @@ window.wp = window.wp || {}; frameBorder: '0', allowTransparency: 'true', scrolling: 'no', + 'class': 'wpview-sandbox', style: { width: '100%', display: 'block' @@ -554,9 +555,10 @@ window.wp = window.wp || {}; pausePlayers: function() { this.getNodes( function( editor, node, content ) { - var p, win = $( 'iframe', content ).get(0).contentWindow; + var p, win, + iframe = $( 'iframe.wpview-sandbox', content ).get(0); - if ( win && win.mejs ) { + if ( iframe && ( win = iframe.contentWindow ) && win.mejs ) { for ( p in win.mejs.players ) { win.mejs.players[p].pause(); } @@ -566,9 +568,10 @@ window.wp = window.wp || {}; unsetPlayers: function() { this.getNodes( function( editor, node, content ) { - var p, win = $( 'iframe', content ).get(0).contentWindow; + var p, win, + iframe = $( 'iframe.wpview-sandbox', content ).get(0); - if ( win && win.mejs ) { + if ( iframe && ( win = iframe.contentWindow ) && win.mejs ) { for ( p in win.mejs.players ) { win.mejs.players[p].remove(); }