Secure opaque-origin content + HTTP editor preview v2#56

Draft

erseco wants to merge 61 commits into

mainfrom

feature/secure-iframe-sandbox

Commits on Jun 14, 2026

Render external embeds (YouTube/Vimeo/PDF) inline in secure mode
erseco
committed
Report absolute embed URLs from the shim (resolve relative srcs)
erseco
committed
Add Firefox e2e for secure-mode external embeds
erseco
committed
Keep the embed Firefox e2e out of the WordPress (chromium/wp-env) Playwright config
erseco
committed
Mirror canonical embed updates: providers, clamp, allow-forms, page-nav fix
erseco
committed
Fix PHPCS: capitalize the allow-forms docblock long description
erseco
committed
Mirror canonical embeds: structural invariant (any cross-origin https) + embed policy
erseco
committed
Update embed e2e for open mode: every cross-origin/PDF iframe promoted + sandboxed
erseco
committed
Revert embed-policy admin UI (untranslated-strings i18n gate); keep open default + exelearning_embed_mode option
erseco
committed

Commits on Jun 17, 2026

Mirror canonical embed hardening: trailing-dot gate, dead-code, Vitest
erseco
committed

Commits on Jun 18, 2026

Merge remote-tracking branch 'origin/main' into feature/secure-iframe-sandbox
erseco
committed

Commits on Jun 26, 2026

Merge branch 'main' into feature/secure-iframe-sandbox
erseco
committed

Commits on Jun 30, 2026

Commits on Jul 2, 2026

docs(embed): repoint embedder header to eXe core as the canonical source
erseco
committed

Commits on Jul 9, 2026

Merge branch 'main' of github.com:exelearning/wp-exelearning into feature/secure-iframe-sandbox
erseco
committed

Commits on Jul 10, 2026

Merge branch 'main' of github.com:exelearning/wp-exelearning into feature/secure-iframe-sandbox
erseco
committed

Commits on Jul 11, 2026

Commits on Jul 12, 2026