Skip to content

Commit d43e835

Browse files
Media: Skip cross-origin isolation for third-party page builders.
Add a check to skip Document-Isolation-Policy when a third-party page builder overrides the block editor via a custom action parameter. DIP isolates the document into its own agent cluster, which blocks same-origin iframe access that these editors rely on. Co-Authored-By: Claude Opus 4.6 <[email protected]>
1 parent a479b0a commit d43e835

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

src/wp-includes/media.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6430,6 +6430,14 @@ function wp_set_up_cross_origin_isolation(): void {
64306430
return;
64316431
}
64326432

6433+
// Skip when a third-party page builder overrides the block editor.
6434+
// DIP isolates the document into its own agent cluster,
6435+
// which blocks same-origin iframe access that these editors rely on.
6436+
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
6437+
if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
6438+
return;
6439+
}
6440+
64336441
// Cross-origin isolation is not needed if users can't upload files anyway.
64346442
if ( ! current_user_can( 'upload_files' ) ) {
64356443
return;

0 commit comments

Comments
 (0)