imterah/element-portable
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sandbox app iframes

Browse source
This commit is contained in:
David Baker 2017-07-12 10:21:43 +01:00
parent 7ae4e96e4d
commit 53316a76f4
2 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/components/views/elements/AppTile.js
View file

@ -121,7 +121,14 @@ export default React.createClass({
} else {
appTileBody = (
<div className="mx_AppTileBody">
<iframe ref="appFrame" src={this.state.widgetUrl} allowFullScreen="true"></iframe>
// Note that there is advice saying allow-scripts shouldn;t be used with allow-same-origin
// because that would allow the iframe to prgramatically remove the sandbox attribute, but
// this would only be for content hosted on the same origin as the riot client: anything
// hosted on the same origin as the client will get the same access access as if you clicked
// a link to it.
<iframe ref="appFrame" src={this.state.widgetUrl} allowFullScreen="true"
sandbox="allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"
></iframe>
</div>
);
}