Changeset 12094

Timestamp:

09/27/2022 01:33:48 AM (4 years ago)

Author:

dd32

Message:

Support Forums: Don't oEmbed WordPress.org URLs which include anchors in the URL.

Fixes #4346.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-hooks.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-hooks.php

@@ -132 +132 @@
                 add_filter( 'bbp_subscription_mail_message', array( $this, 'bbp_subscription_mail_message'), 5, 3 );
 
+                // Don't embed WordPress.org links with anchors included.
+                add_filter( 'pre_oembed_result', array( $this, 'pre_oembed_result_dont_embed_wordpress_org_anchors' ), 20, 2 );
+
+                // Break users sessions / passwords when they get blocked, on the main forums only.
                 if ( 'wordpress.org' === get_blog_details()->domain ) {
-                        // Break users sessions / passwords when they get blocked, on the main forums only.
                         add_action( 'bbp_set_user_role', array( $this, 'user_blocked_password_handler' ), 10, 3 );
                 }
@@ -1314 +1317 @@
 
         /**
+         * Don't embed WordPress.org links when anchors are included.
+         *
+         * NOTE: `$return` will have HTML when the link points to the current site, as WordPress uses
+         *       the same filter to preempt HTTP requests, ignoring any earlier filtered results.
+         *
+         * TODO: It may be better wanted to inject the actual hash into the oEmbed iframe instead of
+         *       disabling this rich embed entirely.
+         *
+         * @see https://meta.trac.wordpress.org/ticket/4346
+         */
+        public function pre_oembed_result_dont_embed_wordpress_org_anchors( $return, $url ) {
+                // Match WordPress.org + Subdomains which includes a Hash character in the URL.
+                if ( preg_match( '!^https?://([^/]+[.])?wordpress[.]org/.*#!i', $url ) ) {
+                        $return = false;
+                }
+
+                return $return;
+        }
+
+        /**
          * Catch a user being blocked / unblocked and set their password appropriately.
          *