diff -r be944660c56a -r 3d72ae0968f4 wp/wp-includes/embed.php --- a/wp/wp-includes/embed.php Wed Sep 21 18:19:35 2022 +0200 +++ b/wp/wp-includes/embed.php Tue Sep 27 16:37:53 2022 +0200 @@ -57,7 +57,7 @@ * @global int $content_width * * @param string $url Optional. The URL that should be embedded. Default empty. - * @return array { + * @return int[] { * Indexed array of the embed width and height in pixels. * * @type int $0 The embed width. @@ -328,7 +328,7 @@ } /** - * Adds oEmbed discovery links in the website . + * Adds oEmbed discovery links in the head element of the website. * * @since 4.4.0 */ @@ -356,10 +356,44 @@ /** * Adds the necessary JavaScript to communicate with the embedded iframes. * + * This function is no longer used directly. For back-compat it exists exclusively as a way to indicate that the oEmbed + * host JS _should_ be added. In `default-filters.php` there remains this code: + * + * add_action( 'wp_head', 'wp_oembed_add_host_js' ) + * + * Historically a site has been able to disable adding the oEmbed host script by doing: + * + * remove_action( 'wp_head', 'wp_oembed_add_host_js' ) + * + * In order to ensure that such code still works as expected, this function remains. There is now a `has_action()` check + * in `wp_maybe_enqueue_oembed_host_js()` to see if `wp_oembed_add_host_js()` has not been unhooked from running at the + * `wp_head` action. + * * @since 4.4.0 + * @deprecated 5.9.0 Use {@see wp_maybe_enqueue_oembed_host_js()} instead. */ -function wp_oembed_add_host_js() { - wp_enqueue_script( 'wp-embed' ); +function wp_oembed_add_host_js() {} + +/** + * Enqueue the wp-embed script if the provided oEmbed HTML contains a post embed. + * + * In order to only enqueue the wp-embed script on pages that actually contain post embeds, this function checks if the + * provided HTML contains post embed markup and if so enqueues the script so that it will get printed in the footer. + * + * @since 5.9.0 + * + * @param string $html Embed markup. + * @return string Embed markup (without modifications). + */ +function wp_maybe_enqueue_oembed_host_js( $html ) { + if ( + has_action( 'wp_head', 'wp_oembed_add_host_js' ) + && + preg_match( '/]*?wp-embedded-content/', $html ) + ) { + wp_enqueue_script( 'wp-embed' ); + } + return $html; } /** @@ -450,33 +484,18 @@ $embed_url = get_post_embed_url( $post ); - $output = '
' . get_the_title( $post ) . "
\n"; + $secret = wp_generate_password( 10, false ); + $embed_url .= "#?secret={$secret}"; - $output .= ""; + $output = sprintf( + '
%3$s
', + esc_attr( $secret ), + esc_url( get_permalink( $post ) ), + get_the_title( $post ) + ); $output .= sprintf( - '', + '', esc_url( $embed_url ), absint( $width ), absint( $height ), @@ -487,7 +506,17 @@ get_the_title( $post ), get_bloginfo( 'name' ) ) - ) + ), + esc_attr( $secret ) + ); + + // Note that the script must be placed after the
and