Links/forms in ACF block previews navigate the iframed editor canvas on WP 7.1 (crashes editor when cross-origin)

Aperta
  • Qualcosa non va?
#1,046 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
javascript, php, wordpress
Ambito
frontend

Direzione di ricerca

Start with the existing "Navigation prevented for" handling in the acf-pro-blocks scripts, and look at how .acf-block-preview is rendered. Reproduce by adding a block whose render output contains an a with an external href, then clicking it in the editor. Done means clicks on non-hash a[href] and form submits inside the preview no longer navigate the canvas, while block selection still works.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Environment
WordPress 7.1.3 (post editor canvas always iframed, shouldIframe: true)
ACF PRO 6.8.10
Blocks registered via block.json with no block version declared (so V3 by default since 6.8.9), "acf": { "mode": "edit" }, server-rendered with render_callback

Steps to reproduce
Register an ACF block whose render output contains an (any non-# link).
Add it to a post in the block editor on WP 7.1. The preview renders, which is the V3 default.
Click the link in the preview.

Expected
Clicking a link in a block preview selects the block. It doesn’t navigate.

Actual
The click navigates the editor-canvas iframe to the link’s URL. Core’s iframe only intercepts #hash links (interceptLinkClicks in block-editor).
Same-origin link: the frontend page silently replaces the editor canvas.
Cross-origin link: the canvas window becomes cross-origin. The next time a block unmounts or re-renders, the editor crashes with “The editor has encountered an unexpected error”:

SecurityError: Failed to read a named property 'removeEventListener' from 'Window':
Blocked a frame with origin "https://example.com" from accessing a cross-origin frame.
    at wp-includes/js/dist/compose.min.js (useRefEffect cleanup)
    at $e / Bt (useMergeRefs cleanup)

A

in a preview, such as Gravity Forms, navigates the canvas on submit in the same way.

Why this is new
Before 7.1, V2 blocks disabled the iframe, and mode: edit showed the field form rather than the rendered preview. On WP 7.1 with ACF 6.8.9+, these blocks are V3 and show live, clickable server HTML inside an iframe that core doesn’t guard. ACF already prevents navigation for inline-editing elements (Navigation prevented for … in acf-pro-blocks), but not for the rest of the preview.

Suggested fix
Inside .acf-block-preview, preventDefault() capture-phase click events on non-# a[href] and submit events on forms, while leaving propagation alone so block selection still works.

Workaround we’re using
A small mu-plugin that does exactly that, via an inline script on enqueue_block_assets when is_admin() is true.
Lingua principale
PHP
Stelle
947
Fork
198
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AdvancedCustomFields/acf

Tutte le issue di AdvancedCustomFields/acf

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.