wpseek.com
Eine auf WordPress spezialiserte Suchmaschine für Entwickler und Theme-Autoren

function wp_set_up_cross_origin_isolation(): bool {
	if ( ! wp_is_client_side_media_processing_enabled() ) {
		return false;
	}

	$screen = get_current_screen();

	if ( ! $screen ) {
		return false;
	}

	$is_media_screen = 'media' === $screen->id || ( 'upload' === $screen->id && 'grid' === wp_get_media_library_mode() );

	if (
		! $is_media_screen &&
		! $screen->is_block_editor() &&
		'site-editor' !== $screen->id &&
		! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() )
	) {
		return false;
	}

	/*
	 * Skip when rendering the classic-theme home route, which shows the site
	 * preview in an iframe and must reach its `contentDocument` to neutralize
	 * interactive elements. DIP would block that same-origin access.
	 *
	 * Keyed off $pagenow rather than the current screen so the guard keeps
	 * working if the header set-up is ever moved to an earlier hook (such as
	 * admin_init) where the screen is not yet available.
	 */
	global $pagenow;

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
		return false;
	}

	/*
	 * Skip when a third-party page builder overrides the block editor.
	 * DIP isolates the document into its own agent cluster,
	 * which blocks same-origin iframe access that these editors rely on.
	 */
	if ( ! $is_media_screen && isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
		return false;
	}

	// Cross-origin isolation is not needed if users can't upload files anyway.
	if ( ! current_user_can( 'upload_files' ) ) {
		return false;
	}

	return wp_send_document_isolation_policy_header();
}