| @@ -4,13 +4,8 @@ | ||
| 4 | 4 | * |
| 5 | 5 | * @package gutenberg |
| 6 | 6 | */ |
| 7 | 7 | |
| 8 | -// Client-side media processing is currently plugin-only while the feature matures. | |
| 9 | -if ( ! defined( 'IS_GUTENBERG_PLUGIN' ) || ! IS_GUTENBERG_PLUGIN ) { | |
| 10 | - return; | |
| 11 | -} | |
| 12 | - | |
| 13 | 8 | if ( ! gutenberg_is_client_side_media_processing_enabled() ) { |
| 14 | 9 | return; |
| 15 | 10 | } |
| 16 | 11 | |
| @@ -224,30 +219,14 @@ | ||
| 224 | 219 | |
| 225 | 220 | add_filter( 'mod_rewrite_rules', 'gutenberg_filter_mod_rewrite_rules' ); |
| 226 | 221 | |
| 227 | 222 | /** |
| 228 | - * Returns the major Chromium version from the current request's User-Agent. | |
| 229 | - * | |
| 230 | - * Matches all Chromium-based browsers (Chrome, Edge, Opera, Brave). | |
| 231 | - * | |
| 232 | - * @return int|null The major Chromium version, or null if not a Chromium browser. | |
| 233 | - */ | |
| 234 | -function gutenberg_get_chromium_major_version(): ?int { | |
| 235 | - if ( empty( $_SERVER['HTTP_USER_AGENT'] ) ) { | |
| 236 | - return null; | |
| 237 | - } | |
| 238 | - if ( preg_match( '/Chrome\/(\d+)/', $_SERVER['HTTP_USER_AGENT'], $matches ) ) { | |
| 239 | - return (int) $matches[1]; | |
| 240 | - } | |
| 241 | - return null; | |
| 242 | -} | |
| 243 | - | |
| 244 | -/** | |
| 245 | 223 | * Enables cross-origin isolation in the block editor. |
| 246 | 224 | * |
| 247 | 225 | * Required for enabling SharedArrayBuffer for WebAssembly-based |
| 248 | - * media processing in the editor. Uses Document-Isolation-Policy | |
| 249 | - * on supported browsers (Chromium 137+). | |
| 226 | + * media processing in the editor. | |
| 227 | + * | |
| 228 | + * @link https://web.dev/coop-coep/ | |
| 250 | 229 | */ |
| 251 | 230 | function gutenberg_set_up_cross_origin_isolation() { |
| 252 | 231 | // Re-check the filter at action time, since other plugins (loaded after Gutenberg) |
| 253 | 232 | // may have added a filter to disable client-side media processing. |
| @@ -264,16 +243,8 @@ | ||
| 264 | 243 | if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) { |
| 265 | 244 | return; |
| 266 | 245 | } |
| 267 | 246 | |
| 268 | - // Skip when a third-party page builder overrides the block editor. | |
| 269 | - // DIP isolates the document into its own agent cluster, | |
| 270 | - // which blocks same-origin iframe access that these editors rely on. | |
| 271 | - // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 272 | - if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) { | |
| 273 | - return; | |
| 274 | - } | |
| 275 | - | |
| 276 | 247 | $user_id = get_current_user_id(); |
| 277 | 248 | if ( ! $user_id ) { |
| 278 | 249 | return; |
| 279 | 250 | } |
| @@ -290,46 +261,26 @@ | ||
| 290 | 261 | add_action( 'load-post-new.php', 'gutenberg_set_up_cross_origin_isolation' ); |
| 291 | 262 | add_action( 'load-site-editor.php', 'gutenberg_set_up_cross_origin_isolation' ); |
| 292 | 263 | add_action( 'load-widgets.php', 'gutenberg_set_up_cross_origin_isolation' ); |
| 293 | 264 | |
| 294 | -// Remove core's COEP/COOP-based cross-origin isolation in favor of | |
| 295 | -// Gutenberg's DIP-based approach, which also skips third-party editors. | |
| 296 | -remove_action( 'load-post.php', 'wp_set_up_cross_origin_isolation' ); | |
| 297 | -remove_action( 'load-post-new.php', 'wp_set_up_cross_origin_isolation' ); | |
| 298 | -remove_action( 'load-site-editor.php', 'wp_set_up_cross_origin_isolation' ); | |
| 299 | -remove_action( 'load-widgets.php', 'wp_set_up_cross_origin_isolation' ); | |
| 300 | - | |
| 301 | 265 | /** |
| 302 | - * Sends the Document-Isolation-Policy header for cross-origin isolation. | |
| 266 | + * Sends headers for cross-origin isolation. | |
| 303 | 267 | * |
| 304 | 268 | * Uses an output buffer to add crossorigin="anonymous" where needed. |
| 269 | + * | |
| 270 | + * @link https://web.dev/coop-coep/ | |
| 271 | + * | |
| 272 | + * @global bool $is_safari | |
| 305 | 273 | */ |
| 306 | 274 | function gutenberg_start_cross_origin_isolation_output_buffer(): void { |
| 307 | - $chromium_version = gutenberg_get_chromium_major_version(); | |
| 275 | + global $is_safari; | |
| 308 | 276 | |
| 309 | - /** | |
| 310 | - * Filters whether to use Document-Isolation-Policy for cross-origin isolation. | |
| 311 | - * | |
| 312 | - * Document-Isolation-Policy provides per-document cross-origin isolation | |
| 313 | - * without affecting other iframes on the page, avoiding breakage of plugins | |
| 314 | - * whose iframes lose credentials/DOM access. | |
| 315 | - * | |
| 316 | - * @since 21.8.0 | |
| 317 | - * | |
| 318 | - * @param bool $use_dip Whether DIP is supported and should be used. | |
| 319 | - */ | |
| 320 | - $use_dip = apply_filters( | |
| 321 | - 'gutenberg_use_document_isolation_policy', | |
| 322 | - null !== $chromium_version && $chromium_version >= 137 | |
| 323 | - ); | |
| 277 | + $coep = $is_safari ? 'require-corp' : 'credentialless'; | |
| 324 | 278 | |
| 325 | - if ( ! $use_dip ) { | |
| 326 | - return; | |
| 327 | - } | |
| 328 | - | |
| 329 | 279 | ob_start( |
| 330 | - function ( string $output ): string { | |
| 331 | - header( 'Document-Isolation-Policy: isolate-and-credentialless' ); | |
| 280 | + function ( string $output ) use ( $coep ): string { | |
| 281 | + header( 'Cross-Origin-Opener-Policy: same-origin' ); | |
| 282 | + header( "Cross-Origin-Embedder-Policy: $coep" ); | |
| 332 | 283 | |
| 333 | 284 | return gutenberg_add_crossorigin_attributes( $output ); |
| 334 | 285 | } |
| 335 | 286 | ); |
| @@ -349,8 +300,9 @@ | ||
| 349 | 300 | |
| 350 | 301 | // See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin. |
| 351 | 302 | $tags = array( |
| 352 | 303 | 'AUDIO' => 'src', |
| 304 | + 'IMG' => 'src', | |
| 353 | 305 | 'LINK' => 'href', |
| 354 | 306 | 'SCRIPT' => 'src', |
| 355 | 307 | 'VIDEO' => 'src', |
| 356 | 308 | 'SOURCE' => 'src', |
