Prevent handling XHR request if _wp_amp_action_xhr_converted query va…

…r absent
ampproject · Mar 21, 2018 · f3218ea · f3218ea
1 parent 93b9577
commit f3218ea
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/includes/class-amp-theme-support.php b/includes/class-amp-theme-support.php
@@ -363,7 +363,14 @@ public static function send_header( $name, $value, $args = array() ) {
 	 * @since 0.7.0
 	 */
 	public static function handle_xhr_request() {
-		if ( empty( self::$purged_amp_query_vars['__amp_source_origin'] ) || empty( $_SERVER['REQUEST_METHOD'] ) || 'POST' !== $_SERVER['REQUEST_METHOD'] ) {
+		$is_amp_xhr = (
+			! empty( self::$purged_amp_query_vars['_wp_amp_action_xhr_converted'] )
+			&&
+			! empty( self::$purged_amp_query_vars['__amp_source_origin'] )
+			&&
+			( ! empty( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] )
+		);
+		if ( ! $is_amp_xhr ) {
 			return;
 		}
 

diff --git a/tests/test-class-amp-theme-support.php b/tests/test-class-amp-theme-support.php
@@ -279,6 +279,8 @@ public function test_handle_xhr_request() {
 		AMP_Theme_Support::handle_xhr_request();
 		$this->assertEmpty( AMP_Theme_Support::$headers_sent );
 
+		$_GET['_wp_amp_action_xhr_converted'] = '1';
+
 		// Try bad source origin.
 		$_GET['__amp_source_origin'] = 'http://evil.example.com/';
 		$_SERVER['REQUEST_METHOD']   = 'POST';