| @@ -37,19 +37,33 @@ | ||
| 37 | 37 | return; |
| 38 | 38 | } |
| 39 | 39 | |
| 40 | 40 | if ( ! $this->is_allowed() ) { |
| 41 | - if ( Utils::is_iframe() ) { | |
| 41 | + if ( Utils::is_iframe() || ! Utils::has_fetch_metadata() ) { | |
| 42 | 42 | $http_host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : ''; |
| 43 | 43 | $request_uri = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : ''; |
| 44 | 44 | $scheme = empty($_SERVER['HTTPS']) ? 'http' : 'https'; |
| 45 | 45 | $actual_link = $scheme . '://' . $http_host . $request_uri; |
| 46 | - Frames::custom_plugin_change_reload($actual_link); | |
| 46 | + | |
| 47 | + if ( Utils::is_iframe() ) { | |
| 48 | + Frames::custom_plugin_change_reload($actual_link); | |
| 49 | + } else { | |
| 50 | + // No Fetch Metadata to go by - let the browser decide | |
| 51 | + // whether this really is the Adminify iframe. | |
| 52 | + Frames::maybe_break_out_of_frame($actual_link); | |
| 53 | + } | |
| 47 | 54 | } |
| 48 | 55 | return; |
| 49 | 56 | } |
| 50 | 57 | |
| 51 | - if ( Utils::is_iframe() ) { | |
| 58 | + // Without Fetch Metadata a POST is treated as coming from the frame: | |
| 59 | + // the shell template prints during `admin_init`, so rendering it for a | |
| 60 | + // form submission sends output before WordPress can redirect and the | |
| 61 | + // request dead-ends on a blank page. Submissions in a running Adminify | |
| 62 | + // UI always originate inside the iframe anyway. | |
| 63 | + $is_frame = Utils::is_iframe() || ( ! Utils::has_fetch_metadata() && ! Utils::is_get_request() ); | |
| 64 | + | |
| 65 | + if ( $is_frame ) { | |
| 52 | 66 | $this->frame = new Frames(); |
| 53 | 67 | } else { |
| 54 | 68 | $this->admin = new Admin(); |
| 55 | 69 | } |
