Customizer / Posts: load the Customizer and post previews on sites that disallow iframes #3291
Conversation
mattwiebe
added
[Feature] Post/Page Editor
|
|
||
| query.return = protocol + '//' + host + this.getPreviousPath(); | ||
| query.calypso = true; | ||
| query.calypsoOrigin = protocol + '//' + host; | ||
| if ( site.options.frame_nonce ) { |
There was a problem hiding this comment.
May need to guard against missing options attribute with site.options && site.options.frame_nonce.
There was a problem hiding this comment.
I doubt we get site responses without options, but can't hurt.
|
Thanks for tackling this one! |
|
Testing this pull, fixes the Customizer iframe issue for me — testing with an a8c private P2 site in local Calypso install on this branch. w00t! |
mtias
added
[Status] Needs Author Reply
and removed
[Status] Needs Review
| parsed.query['frame-nonce'] = site.options.frame_nonce; | ||
| delete parsed.search; | ||
| previewUrl = url.format( parsed ); | ||
| } |
There was a problem hiding this comment.
This function desperately needs unit tests, though understandably non-existent at the moment. I might suggest that you consider adding one to the existing utils test suite:
describe( '#getPreviewURL', function() {
it( 'should include a frame nonce when post has site defined', function() {
// ...
} );
} );Not a blocker, but we should be more diligent about testing.
There was a problem hiding this comment.
As much as it pains me to say, I'm gonna punt on that, since fixing everything here has already turned into a giant interdimensional rabbit hole.
mattwiebe
force-pushed
the
fix/secure-iframe-embeds
branch
from
9eda6c8
to
8086502
Compare
We have some higher-security sites that always force the `x-frame-options: SAMEORIGIN` HTTP header, breaking the Customizer and post previewing. We allow unsetting this header through a nonce, which is now included in REST API responses for sites. This may pave the way for increasing the security for everyone by enabling said HTTP header on all WP.com sites.
mattwiebe
added
[Status] Needs Review
|
👍 |
mtias
added
[Status] Ready to Merge
and removed
[Status] Needs Review
Customizer / Posts: load the Customizer and post previews on sites that disallow iframes
We have some higher-security sites that always force the
x-frame-options: SAMEORIGINHTTP header, breaking the Customizer and post previewing. We allow unsetting this header
through a nonce, which is now included in REST API responses for sites.
This may pave the way for increasing the security for everyone by enabling said HTTP
header on all WP.com sites.
To Test
Someone from Automattic will need to try post previews and/or the Customizer with an internal site. You may need to clear out your
localStorageto ensure that your site responses are fresh and contain the nonce (site.options.frame_nonce)