0-playground.php

<?php
// PHP < 5.3 doesn't support anonymous functions (closures) at all,
// and WordPress < 3.0 can't handle them as hook callbacks. Skip this
// mu-plugin entirely for either.
if (version_compare(PHP_VERSION, '5.3', '<')
	|| (isset($GLOBALS['wp_version']) && version_compare($GLOBALS['wp_version'], '3.0', '<'))) {
	return;
}

/**
 * Add a notice to wp-login.php offering the username and password.
 */
add_filter(
	'login_message',
	function ( $message ) {
		return $message . <<<EOT
<div class="message info">
	<strong>username:</strong> <code>admin</code><br><strong>password</strong>: <code>password</code>
</div>
EOT;
	}
);

/**
 * Because the in-browser Playground doesn't have access to the internet,
 * network-dependent features like directories don't work. Normally, you'll
 * see a confusing message like "An unexpected error occurred." This mu-plugin
 * makes it more clear that the feature is not yet supported.
 *
 * https://github.com/WordPress/wordpress-playground/issues/498
 *
 * Added styling to hide the Popular tags section of the Plugins page
 * and the nonfunctional Try Again button (both Plugins and Themes) that's
 * appended when the message is displayed.
 *
 * https://github.com/WordPress/wordpress-playground/issues/927
 *
 */
add_action('admin_head', function () {
	echo '<style>
				:is(.plugins-popular-tags-wrapper:has(div.networking_err_msg),
				button.button.try-again) {
						display: none;
				}
		</style>';
});

/**
 * Opt Playground pages into browser-native cross-document View Transitions.
 *
 * This lets the browser keep the outgoing page visible until the incoming page
 * is ready, without intercepting clicks or emulating navigation.
 * The rules are intentionally low-specificity and printed early, so themes,
 * plugins, and user code can override them with ordinary CSS.
 */
function playground_enable_view_transitions() {
	if ( playground_has_wordpress_view_transitions() ) {
		return;
	}

	?>
	<style>
		@media (prefers-reduced-motion: no-preference) {
			@view-transition {
				navigation: auto;
			}

			::view-transition-group(root),
			::view-transition-old(root),
			::view-transition-new(root) {
				animation-delay: 0s;
				animation-duration: 0s;
			}

			::view-transition-old(root),
			::view-transition-new(root) {
				mix-blend-mode: normal;
			}
		}
	</style>
	<?php
}

/**
 * Checks whether WordPress already owns View Transitions for this request.
 *
 * The Playground fallback avoids named transitions, but it should still step
 * aside when Core or the feature plugin can define its own root transition.
 */
function playground_has_wordpress_view_transitions() {
	// The standalone View Transitions feature plugin defines these globally.
	if ( defined( 'VIEW_TRANSITIONS_VERSION' )
		|| function_exists( 'plvt_load_view_transitions' ) ) {
		return true;
	}

	if ( ! function_exists( 'is_admin' ) || ! is_admin() ) {
		return false;
	}

	// Core exposes these helpers while its admin View Transitions are available.
	if ( function_exists( 'wp_get_view_transitions_admin_css' )
		|| function_exists( 'wp_enqueue_view_transitions_admin_css' ) ) {
		return true;
	}

	return function_exists( 'wp_style_is' )
		&& (
			wp_style_is( 'wp-view-transitions-admin', 'enqueued' )
			|| wp_style_is( 'wp-view-transitions-admin', 'done' )
		);
}
add_action( 'wp_head', 'playground_enable_view_transitions', 0 );
add_action( 'admin_print_styles', 'playground_enable_view_transitions', 0 );
add_action( 'login_head', 'playground_enable_view_transitions', 0 );

add_action('init', 'networking_disabled');
function networking_disabled() {
	$networking_err_msg = '<div class="networking_err_msg">Network access is an <a href="https://github.com/WordPress/wordpress-playground/issues/85" target="_blank" rel="noopener noreferrer">experimental, opt-in feature<span class="screen-reader-text"> (opens in a new tab)</span></a>, which means you need to enable it to allow Playground to access the Plugins/Themes directories.
	<p>There are two alternative methods to enable global networking support:</p>
	<ol>
	<li>Using the <a href="https://wordpress.github.io/wordpress-playground/developers/apis/query-api/" target="_blank" rel="noopener noreferrer">Query API<span class="screen-reader-text"> (opens in a new tab)</span></a>: for example, https://playground.wordpress.net/<em>?networking=yes</em> <strong>or</strong>
	<li> Using the <a href="https://wordpress.github.io/wordpress-playground/blueprints/data-format/#features" target="_blank" rel="noopener noreferrer">Blueprint API<span class="screen-reader-text"> (opens in a new tab)</span></a>: add <code>"features": { "networking": true }</code> to the JSON file.
	</li></ol>
	<p>
	When browsing Playground as a standalone instance, you can enable networking via the settings panel: select the option "Network access (e.g. for browsing plugins)" and hit the "Apply changes" button.<p>
	<strong>Please note:</strong> This option is hidden when browsing Playground as an embedded iframe.</p></div>';
	return $networking_err_msg;
}

add_filter('plugins_api_result', function ($res) {
	if ($res instanceof WP_Error) {
		$res = new WP_Error(
			'plugins_api_failed',
			networking_disabled()
		);
	}
	return $res;
});

add_filter('gettext', function ($translation, $text = '', $domain = 'default') {
	$pagenow = isset($GLOBALS['pagenow']) ? $GLOBALS['pagenow'] : '';
	if ('theme-install.php' === $pagenow) {
		if (strpos($text, 'An unexpected error occurred.') !== false || $translation === 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="%s">support forums</a>.') {
			return networking_disabled();
		}
	}
	return $translation;
}, 10, 3);

/**
 * Links with target="top" don't work in the playground iframe because of
 * the sandbox attribute. What they really should be targeting is the
 * playground iframe itself (name="playground"). This mu-plugin rewrites
 * all target="_top" links to target="playground" instead.
 *
 * https://github.com/WordPress/wordpress-playground/issues/266
 */
add_action('admin_print_scripts', function () {
	?>
	<script>
		document.addEventListener('click', function (event) {
			if (event.target.tagName === 'A' && ['_parent', '_top'].includes(event.target.target)) {
				event.target.target = 'wordpress-playground';
			}
		});
	</script>
	<?php
});

/**
 * Adds target="_blank" to external links when clicked to open them in a new tab.
 * This prevents users from loading non-Playground pages inside the Playground iframe.
 */
function playground_add_target_blank_to_external_links() {
	// Only run on frontend and admin pages, not during AJAX requests or CLI
	if (empty($_SERVER['REQUEST_URI']) || (function_exists('wp_doing_ajax') && wp_doing_ajax()) || (function_exists('wp_doing_cron') && wp_doing_cron())) {
		return;
	}

	?>
	<script>
		function addTargetBlankToExternalLinks() {
			function addTargetBlank(a) {
				const url = new URL(a.href, location);
				if (url.origin !== location.origin) {
					a.target = '_blank';
				}
			}

			// Set target="_blank" for existing external links – this
			// covers keyboard navigation.
			document.querySelectorAll('a[href]').forEach(a => {
				addTargetBlank(a);
			});

			// Set target="_blank" for external links when clicked.
			// This covers links that are added after the page has loaded.
			document.addEventListener('click', e => {
				// window, document, SVG Text nodes etc. don't have the `closest` method
				if ( !e.target?.closest ) {
					return;
				}
				const a = e.target.closest('a[href]');
				if (!a) return;
				addTargetBlank(a);
			});

			// Also handle focus events to cover keyboard navigation on
			// links that are added after the page has loaded.
			document.addEventListener('focus', e => {
				// window, document, SVG Text nodes etc. don't have the `closest` method
				if ( !e.target?.closest ) {
					return;
				}
				const a = e.target?.closest('a[href]');
				if (!a) return;
				addTargetBlank(a);
			}, true);
		}

		if (document.readyState === 'loading') {
			document.addEventListener('DOMContentLoaded', addTargetBlankToExternalLinks);
		} else {
			addTargetBlankToExternalLinks();
		}
	</script>

	<?php
}
add_action('wp_head', 'playground_add_target_blank_to_external_links');
add_action('admin_head', 'playground_add_target_blank_to_external_links');

/**
 * Reports the current URL to the parent frame.
 *
 * When Document-Isolation-Policy is enabled, the parent frame can't access
 * the iframe's location.href due to cross-origin restrictions. This script
 * posts a message to the parent frame with the current URL so the address
 * bar can be updated.
 *
 * @see https://github.com/WordPress/wordpress-playground/issues/2954
 */
function playground_report_url_to_parent() {
	?>
	<script>
		if (window.parent !== window) {
			window.parent.postMessage(
				JSON.stringify({
					type: 'playground-url-change',
					url: window.location.href
				}),
				window.location.origin
			);
		}
	</script>
	<?php
}
add_action('wp_head', 'playground_report_url_to_parent');
add_action('admin_head', 'playground_report_url_to_parent');

/**
 * Captures this document when the trusted Playground parent requests a site
 * thumbnail. The renderer is loaded only for a capture, so normal WordPress
 * page loads do not pay its download or execution cost.
 *
 * This must run inside the WordPress document rather than reading the iframe
 * DOM from the remote frame. For example, a plugin may send
 * `Cross-Origin-Embedder-Policy: require-corp` and
 * `Cross-Origin-Opener-Policy: same-origin` on the front page. In browsers
 * that support Document-Isolation-Policy, Playground's service worker rewrites
 * those headers to `Document-Isolation-Policy: isolate-and-require-corp`.
 * Because the remote frame does not have the matching policy, the browser
 * blocks its synchronous access to `iframe.contentDocument`, even though both
 * frames are same-origin. The listener below therefore captures in the
 * WordPress document and returns the thumbnail with `postMessage()`.
 */
function playground_enable_site_thumbnail_capture() {
	?>
	<script>
		(function () {
			if (window.__playgroundSiteThumbnailCaptureEnabled) {
				return;
			}
			window.__playgroundSiteThumbnailCaptureEnabled = true;

			window.addEventListener('message', async function (event) {
				// The origin protects the trust boundary. Checking source as well
				// prevents another same-origin frame from requesting code execution.
				if (
					event.source !== window.parent ||
					event.origin !== window.location.origin ||
					event.data?.type !== 'playground-capture-site-thumbnail'
				) {
					return;
				}

				const request = event.data;
				try {
					if (
						typeof request.moduleUrl !== 'string' ||
						!request.moduleUrl
					) {
						throw new Error('Missing site thumbnail module URL.');
					}
					// Dynamic import executes inside the WordPress document. Accept only
					// the same-origin renderer asset marked by the trusted parent.
					const moduleUrl = new URL(request.moduleUrl);
					const isRendererModule =
						moduleUrl.pathname ===
							'/src/lib/capture-site-thumbnail.ts' ||
						/^\/capture-site-thumbnail-[A-Za-z0-9_-]+\.js$/.test(
							moduleUrl.pathname
						);
					if (
						moduleUrl.origin !== event.origin ||
						!isRendererModule ||
						moduleUrl.searchParams.get(
							'playground-site-thumbnail-module'
						) !== '1'
					) {
						throw new Error('Invalid site thumbnail module URL.');
					}
					await import(moduleUrl.href);
					if (typeof window.__playgroundCaptureSiteThumbnail !== 'function') {
						throw new Error('Site thumbnail renderer did not load.');
					}
					const thumbnail = await window.__playgroundCaptureSiteThumbnail();
					window.parent.postMessage(
						{
							type: 'playground-site-thumbnail-result',
							requestId: request.requestId,
							thumbnail,
						},
						event.origin
					);
				} catch (error) {
					window.parent.postMessage(
						{
							type: 'playground-site-thumbnail-result',
							requestId: request.requestId,
							error:
								error instanceof Error
									? error.message
									: String(error),
						},
						event.origin
					);
				}
			});
		})();
	</script>
	<?php
}
add_action('wp_head', 'playground_enable_site_thumbnail_capture');
add_action('admin_head', 'playground_enable_site_thumbnail_capture');

/**
 * The default WordPress requests transports have been disabled
 * at this point. However, the Requests class requires at least
 * one working transport or else it throws warnings and acts up.
 *
 * This mu-plugin provides that transport. It's one of the two:
 *
 * * WP_Http_Fetch – Sends requests using browser's fetch() function.
 * * WP_Http_Dummy – Does not send any requests and only exists to keep
 * 								the Requests class happy.
 */
$__requests_class = class_exists( '\WpOrg\Requests\Requests' ) ? '\WpOrg\Requests\Requests' : ( class_exists( 'Requests' ) ? 'Requests' : null );
if (defined('USE_FETCH_FOR_REQUESTS') && USE_FETCH_FOR_REQUESTS) {
	require(__DIR__ . '/playground-includes/wp_http_fetch.php');
	/**
	 * Force the Fetch transport to be used in Requests.
	 */
	add_action( 'requests-requests.before_request', function( $url, $headers, $data, $type, &$options ) {
		$options['transport'] = 'Wp_Http_Fetch';
	}, 10, 5 );

	/**
	 * Force wp_http_supports() to work, which uses deprecated WP_HTTP methods.
	 * This filter is deprecated, and no longer actively used, but is needed for wp_http_supports().
	 * @see https://core.trac.wordpress.org/ticket/37708
	 */
	add_filter('http_api_transports', function() {
		return array( 'Fetch' );
	});

	/**
	 * Disable signature verification as it doesn't seem to work with
	 * fetch requests:
	 *
	 * https://downloads.wordpress.org/plugin/classic-editor.zip returns no signature header.
	 * https://downloads.wordpress.org/plugin/classic-editor.zip.sig returns 404.
	 *
	 * @TODO Investigate why.
	 */
	add_filter('wp_signature_hosts', function ($hosts) {
		return array();
	});
} else {
	require(__DIR__ . '/playground-includes/wp_http_dummy.php');
	if ( $__requests_class ) {
		$__requests_class::add_transport('Wp_Http_Dummy');
	}

	add_action( 'requests-requests.before_request', function( $url, $headers, $data, $type, &$options ) {
		$options['transport'] = 'Wp_Http_Dummy';
	}, 10, 5 );

	add_filter('http_api_transports', function() {
		return array( 'Dummy' );
	});
}

/**
 * Disable the pattern picker modal to prevent iOS Safari memory crashes.
 * @see https://github.com/WordPress/gutenberg/issues/75019
 */
add_action('init', function() {
	if (defined('PLAYGROUND_ALLOW_PATTERN_PICKER') && PLAYGROUND_ALLOW_PATTERN_PICKER) return;
	if (!function_exists('get_current_user_id')) return;
	$user_id = get_current_user_id();
	if (!$user_id) return;

	$prefs = get_user_meta($user_id, 'wp_persisted_preferences', true) ?: array();
	if (!isset($prefs['core'])) $prefs['core'] = array();
	$prefs['core']['enableChoosePatternModal'] = false;
	update_user_meta($user_id, 'wp_persisted_preferences', $prefs);
});

/**
 * Disable the WP Cron.
 * 
 * Around WordPress 7.0 beta 1, many wp-cron requests in the Playground started
 * taking the full 30 seconds to complete. Since we're running PHP on a single
 * worker, that blocks every other request from running until WP Cron completes.
 */
if ( ! defined( 'DISABLE_WP_CRON' ) ) {
	define( 'DISABLE_WP_CRON', true );
}
$php_self = isset( $_SERVER['PHP_SELF'] ) ? $_SERVER['PHP_SELF'] : '';
if ( '' !== $php_self && str_ends_with( $php_self, '/wp-cron.php' ) ) {
	http_response_code(503);
	header('Content-Type: text/plain');
	echo 'WP Cron is temporarily disabled in the Playground.';
	exit;
}