wp_set_up_cross_origin_isolation()

6646function wp_set_up_cross_origin_isolation(): void {6647	if ( ! wp_is_client_side_media_processing_enabled() ) {6648		return;6649	}6650 6651	$screen = get_current_screen();6652 6653	if ( ! $screen ) {6654		return;6655	}6656 6657	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {6658		return;6659	}6660 6661	/*6662	 * Skip when rendering the classic-theme home route, which shows the site6663	 * preview in an iframe and must reach its `contentDocument` to neutralize6664	 * interactive elements. DIP would block that same-origin access.6665	 *6666	 * Keyed off $pagenow rather than the current screen so the guard keeps6667	 * working if the header set-up is ever moved to an earlier hook (such as6668	 * admin_init) where the screen is not yet available.6669	 */6670	global $pagenow;6671 6672	// phpcs:ignore WordPress.Security.NonceVerification.Recommended6673	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {6674		return;6675	}6676 6677	/*6678	 * Skip when a third-party page builder overrides the block editor.6679	 * DIP isolates the document into its own agent cluster,6680	 * which blocks same-origin iframe access that these editors rely on.6681	 */6682	if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {6683		return;6684	}6685 6686	// Cross-origin isolation is not needed if users can't upload files anyway.6687	if ( ! current_user_can( 'upload_files' ) ) {6688		return;6689	}6690 6691	wp_start_cross_origin_isolation_output_buffer();6692}