You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Document-Isolation-Policy header scope is too narrow, breaking cross-window communication across admin screens #77633
The Document-Isolation-Policy (DIP) header introduced in #75991 is only attached to a narrow set of block-editor page loads:
`load-post.php`
`load-post-new.php`
`load-site-editor.php`
`load-widgets.php`
Because DIP places each document into its own agent cluster, any admin screen that does not send the header ends up in a different agent cluster than the editor. Navigating between these screens (e.g., from the Site Editor to the Templates list, or from a pattern-edit popup back to its opener) breaks:
Cross-window `postMessage` / `window.opener` communication used by preview popups and pattern editing.
Agent-cluster continuity expected by SharedArrayBuffer-backed WASM media processing.
The workaround we've had to add to several E2E tests (`gutenberg-test-plugin-disable-client-side-media-processing`) is a symptom of the same issue — those specs were failing specifically because navigation crossed an agent-cluster boundary.
Steps to reproduce
On Chromium 137+, open the Site Editor.
Trigger any flow that relies on a cross-window handshake (e.g., pattern create-from-selection, template revert, preview popup, cross-admin navigation back to the editor).
Observe broken popup reuse, missing `window.opener`, or lost SharedArrayBuffer context.
Expected behavior
DIP should be sent consistently across all admin pages (subject to capability and feature checks), so admin navigations stay within a single agent cluster.
Proposed fix
Attach DIP via `admin_init` rather than the narrow `load-*.php` set, gate on `current_user_can( 'upload_files' )`, and preserve the existing skip for third-party page builders that override the block editor via an `action` query parameter. DIP remains admin-only — front-end previews are explicitly out of scope.
Activity