Media: Add tests for secure origin check

Add unit tests verifying that client-side media processing
is disabled on non-secure, non-localhost origins and enabled
on localhost regardless of SSL.

Author: adamsilverstein

tests/phpunit/tests/media/wpCrossOriginIsolation.php

@@ -6,6 +6,7 @@
  * @group media
  * @covers ::wp_set_up_cross_origin_isolation
  * @covers ::wp_start_cross_origin_isolation_output_buffer
+ * @covers ::wp_is_client_side_media_processing_enabled
  */
 class Tests_Media_wpCrossOriginIsolation extends WP_UnitTestCase {
 
@@ -16,9 +17,33 @@ class Tests_Media_wpCrossOriginIsolation extends WP_UnitTestCase {
 	 */
 	private $original_user_agent;
 
+	/**
+	 * Original HTTP_HOST value.
+	 *
+	 * @var string|null
+	 */
+	private $original_http_host;
+
+	/**
+	 * Original HTTPS value.
+	 *
+	 * @var string|null
+	 */
+	private $original_https;
+
+	/**
+	 * Original $_GET['action'] value.
+	 *
+	 * @var string|null
+	 */
+	private $original_get_action;
+
 	public function set_up() {
 		parent::set_up();
 		$this->original_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : null;
+		$this->original_http_host  = isset( $_SERVER['HTTP_HOST'] ) ? $_SERVER['HTTP_HOST'] : null;
+		$this->original_https      = isset( $_SERVER['HTTPS'] ) ? $_SERVER['HTTPS'] : null;
+		$this->original_get_action = isset( $_GET['action'] ) ? $_GET['action'] : null;
 	}
 
 	public function tear_down() {
@@ -28,6 +53,24 @@ public function tear_down() {
 			$_SERVER['HTTP_USER_AGENT'] = $this->original_user_agent;
 		}
 
+		if ( null === $this->original_http_host ) {
+			unset( $_SERVER['HTTP_HOST'] );
+		} else {
+			$_SERVER['HTTP_HOST'] = $this->original_http_host;
+		}
+
+		if ( null === $this->original_https ) {
+			unset( $_SERVER['HTTPS'] );
+		} else {
+			$_SERVER['HTTPS'] = $this->original_https;
+		}
+
+		if ( null === $this->original_get_action ) {
+			unset( $_GET['action'] );
+		} else {
+			$_GET['action'] = $this->original_get_action;
+		}
+
 		// Clean up any output buffers started during tests.
 		while ( ob_get_level() > 1 ) {
 			ob_end_clean();
@@ -124,6 +167,32 @@ public function test_does_not_start_output_buffer_for_safari() {
 		$this->assertSame( $level_before, $level_after, 'Output buffer should not be started for Safari.' );
 	}
 
+	/**
+	 * @ticket 64803
+	 */
+	public function test_client_side_processing_disabled_on_non_secure_origin() {
+		$_SERVER['HTTP_HOST'] = 'example.com';
+		$_SERVER['HTTPS']     = '';
+
+		$this->assertFalse(
+			wp_is_client_side_media_processing_enabled(),
+			'Client-side media processing should be disabled on non-secure, non-localhost origins.'
+		);
+	}
+
+	/**
+	 * @ticket 64803
+	 */
+	public function test_client_side_processing_enabled_on_localhost() {
+		$_SERVER['HTTP_HOST'] = 'localhost';
+		$_SERVER['HTTPS']     = '';
+
+		$this->assertTrue(
+			wp_is_client_side_media_processing_enabled(),
+			'Client-side media processing should be enabled on localhost.'
+		);
+	}
+
 	/**
 	 * This test must run in a separate process because the output buffer
 	 * callback sends HTTP headers via header(), which would fail in the