From 718adc4c9d20e34042eb4f34ad7689a777a7c366 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@xwp.co>
Date: Sat, 13 Nov 2021 07:28:00 +0000
Subject: [PATCH] Embeds: Fix parsing of post embeds in
 `wp_filter_oembed_result()` by appending `wp-embed` script instead of
 prepending it in `get_post_embed_html()`.

Due to the way that the `blockquote` and `iframe` are being parsed with a regular expression in `wp_filter_oembed_result()`, if there is any content at all before the `blockquote` start tag then it will fail to be included in the first matching group. By appending the `wp-embed` script instead of prepending it in `get_post_embed_html()`, then the parsing issue is avoided.

Also use non-greedy match `wp_maybe_enqueue_oembed_host_js()`.

Amends [52132].
Fixes #44632.

Built from https://develop.svn.wordpress.org/trunk@52153


git-svn-id: http://core.svn.wordpress.org/trunk@51745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/embed.php   | 17 +++++++++++------
 wp-includes/version.php |  2 +-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/wp-includes/embed.php b/wp-includes/embed.php
index 338c6a041b..eb71951d34 100644
--- a/wp-includes/embed.php
+++ b/wp-includes/embed.php
@@ -374,7 +374,7 @@ function wp_oembed_add_host_js() {
  * @return string Embed markup (without modifications).
  */
 function wp_maybe_enqueue_oembed_host_js( $html ) {
-	if ( preg_match( '/<blockquote\s[^>]*wp-embedded-content/', $html ) ) {
+	if ( preg_match( '/<blockquote\s[^>]*?wp-embedded-content/', $html ) ) {
 		wp_enqueue_script( 'wp-embed' );
 	}
 	return $html;
@@ -471,11 +471,7 @@ function get_post_embed_html( $width, $height, $post = null ) {
 	$secret     = wp_generate_password( 10, false );
 	$embed_url .= "#?secret={$secret}";
 
-	$output = wp_get_inline_script_tag(
-		file_get_contents( ABSPATH . WPINC . '/js/wp-embed' . wp_scripts_get_suffix() . '.js' )
-	);
-
-	$output .= sprintf(
+	$output = sprintf(
 		'<blockquote class="wp-embedded-content" data-secret="%1$s"><a href="%2$s">%3$s</a></blockquote>',
 		esc_attr( $secret ),
 		esc_url( get_permalink( $post ) ),
@@ -498,6 +494,15 @@ function get_post_embed_html( $width, $height, $post = null ) {
 		esc_attr( $secret )
 	);
 
+	// Note that the script must be placed after the <blockquote> and <iframe> due to a regexp parsing issue in
+	// `wp_filter_oembed_result()`. Because of the regex pattern starts with `|(<blockquote>.*?</blockquote>)?.*|`
+	// wherein the <blockquote> is marked as being optional, if it is not at the beginning of the string then the group
+	// will fail to match and everything will be matched by `.*` and not included in the group. This regex issue goes
+	// back to WordPress 4.4, so in order to not break older installs this script must come at the end.
+	$output .= wp_get_inline_script_tag(
+		file_get_contents( ABSPATH . WPINC . '/js/wp-embed' . wp_scripts_get_suffix() . '.js' )
+	);
+
 	/**
 	 * Filters the embed HTML output for a given post.
 	 *
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3d4db91e53..4d47208a41 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.9-alpha-52152';
+$wp_version = '5.9-alpha-52153';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.