← All changes | core/editor/editor.php +12 -83 4.2.0-dev2 → 3.28.0-dev2 View file →

		@@ -5,13 +5,15 @@
5	5	use Elementor\Core\Common\Modules\Ajax\Module;
6	6	use Elementor\Core\Debug\Loading_Inspection_Manager;
7	7	use Elementor\Core\Editor\Loader\Editor_Loader_Factory;
8	8	use Elementor\Core\Editor\Loader\Editor_Loader_Interface;
	9	+use Elementor\Core\Experiments\Manager as Experiments_Manager;
9	10	use Elementor\Core\Settings\Manager as SettingsManager;
10	11	use Elementor\Plugin;
11	12	use Elementor\TemplateLibrary\Source_Local;
12	13	use Elementor\Utils;
13	14	use Elementor\Core\Editor\Data;
	15	+use Elementor\Modules\EditorAppBar\Module as App_Bar_Module;
14	16
15	17	if ( ! defined( 'ABSPATH' ) ) {
16	18	exit; // Exit if accessed directly.
17	19	}
		@@ -31,8 +33,15 @@
31	33	*/
32	34	const EDITING_CAPABILITY = 'edit_posts';
33	35
34	36	/**
	37	+ * The const is deprecated, it remains here for backward compatibility.
	38	+ *
	39	+ * @deprecated Use App_Bar_Module::EXPERIMENT_NAME instead
	40	+ */
	41	+ const EDITOR_V2_EXPERIMENT_NAME = App_Bar_Module::EXPERIMENT_NAME;
	42	+
	43	+ /**
35	44	* Post ID.
36	45	*
37	46	* Holds the ID of the current post being edited.
38	47	*
		@@ -80,11 +89,11 @@
80	89	*
81	90	* @since 1.0.0
82	91	* @access public
83	92	*
84		- * @param bool $to_die Optional. Whether to die at the end. Default is `true`.
	93	+ * @param bool $die Optional. Whether to die at the end. Default is `true`.
85	94	*/
86		- public function init( $to_die = true ) {
	95	+ public function init( $die = true ) {
87	96	if ( empty( $_REQUEST['post'] ) ) {
88	97	return;
89	98	}
90	99
		@@ -116,10 +125,8 @@
116	125
117	126	// Send MIME Type header like WP admin-header.
118	127	@header( 'Content-Type: ' . get_option( 'html_type' ) . '; charset=' . get_option( 'blog_charset' ) );
119	128
120		- self::send_document_isolation_policy_header();
121		-
122	129	add_filter( 'show_admin_bar', '__return_false' );
123	130
124	131	// Remove all WordPress actions
125	132	remove_all_actions( 'wp_head' );
		@@ -161,9 +168,9 @@
161	168
162	169	$this->get_loader()->print_root_template();
163	170
164	171	// From the action it's an empty string, from tests its `false`
165		- if ( false !== $to_die ) {
	172	+ if ( false !== $die ) {
166	173	die;
167	174	}
168	175	}
169	176
		@@ -539,86 +546,8 @@
539	546
540	547	// Handle autocomplete feature for URL control.
541	548	add_filter( 'wp_link_query_args', [ $this, 'filter_wp_link_query_args' ] );
542	549	add_filter( 'wp_link_query', [ $this, 'filter_wp_link_query' ] );
543		-
544		- add_filter( 'replace_editor', [ $this, 'filter_replace_editor' ], 10, 2 );
545		- }
546		-
547		- /**
548		- * Whether the Document-Isolation-Policy header should be sent on the
549		- * Elementor editor screen and the editor preview iframe.
550		- *
551		- * DIP places the document in its own agent cluster, which is the prerequisite
552		- * for cross-origin isolation features such as SharedArrayBuffer (required by
553		- * WordPress core's client-side media processing introduced in WP 7.1).
554		- *
555		- * Both the editor parent document and the preview iframe must send the same
556		- * DIP header so they join the same agent cluster and synchronous DOM access
557		- * between them (e.g. `iframe.contentWindow.elementorFrontend`) keeps working.
558		- *
559		- * The header is only honored by browsers on a secure context (HTTPS or
560		- * localhost) so the helper short-circuits on insecure origins to avoid
561		- * sending a header that the browser will ignore.
562		- *
563		- * @since 4.1.0
564		- *
565		- * @return bool
566		- */
567		- public static function should_use_document_isolation_policy() {
568		- if ( ! is_ssl() ) {
569		- $raw_host = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '';
570		- $host = strtolower( (string) strtok( $raw_host, ':' ) );
571		-
572		- if ( 'localhost' !== $host && ! str_ends_with( $host, '.localhost' ) ) {
573		- return false;
574		- }
575		- }
576		-
577		- /**
578		- * Filters whether Elementor sends the Document-Isolation-Policy header
579		- * on the editor screen and preview iframe.
580		- *
581		- * @since 4.1.0
582		- *
583		- * @param bool $enabled Whether DIP is enabled. Defaults to true on a secure context.
584		- */
585		- return (bool) apply_filters( 'elementor/editor/use_document_isolation_policy', true );
586		- }
587		-
588		- /**
589		- * Send the Document-Isolation-Policy header for the current response.
590		- *
591		- * Safe to call from both the Elementor editor screen handler and the
592		- * preview iframe handler. No-op when {@see self::should_use_document_isolation_policy()}
593		- * returns false.
594		- *
595		- * @since 4.1.0
596		- */
597		- public static function send_document_isolation_policy_header() {
598		- if ( ! self::should_use_document_isolation_policy() || headers_sent() ) {
599		- return;
600		- }
601		-
602		- header( 'Document-Isolation-Policy: isolate-and-credentialless' );
603		- }
604		-
605		- /**
606		- * Signals to WordPress that Elementor is replacing the block editor on its own editor page,
607		- * so that block-editor-specific behaviour (e.g. WP 7.0 COOP/COEP isolation headers) is not
608		- * applied when the Elementor editor is active.
609		- *
610		- * @param bool $replace Whether the editor is being replaced.
611		- * @param \WP_Post $post The post being edited.
612		- *
613		- * @return bool
614		- */
615		- public function filter_replace_editor( $replace, $post ) {
616		- if ( isset( $_REQUEST['action'] ) && 'elementor' === $_REQUEST['action'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
617		- return true;
618		- }
619		-
620		- return $replace;
621	550	}
622	551
623	552	/**
624	553	* @since 2.2.0