fix: apply sandbox attribute to OnlyOffice/Collabora iframe

owncloud · Apr 4, 2024 · 071d17c · 071d17c
1 parent 00024d4
commit 071d17c
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 1 deletion.
diff --git a/changelog/unreleased/iframe-sandbox-drawio.md b/changelog/unreleased/iframe-sandbox-drawio.md
@@ -1,5 +1,5 @@
 Bugfix: Apply sandbox attribute to iframe in draw-io extension
 
-General hardening of ownCloud Web
+General hardening of ownCloud Web integration with draw.io
 
 https://github.com/owncloud/web/pull/10702
diff --git a/changelog/unreleased/iframe-sandbox-external.md b/changelog/unreleased/iframe-sandbox-external.md
@@ -0,0 +1,5 @@
+Bugfix: Apply sandbox attribute to iframe in app-external extension
+
+General hardening of ownCloud Web integration with OnlyOffice/Collabora
+
+https://github.com/owncloud/web/pull/10702
diff --git a/packages/web-app-external/src/App.vue b/packages/web-app-external/src/App.vue
@@ -5,6 +5,7 @@
     class="oc-width-1-1 oc-height-1-1"
     :title="iFrameTitle"
     allowfullscreen
+    sandbox="allow-scripts allow-same-origin"
   />
   <div v-if="appUrl && method === 'POST' && formParameters" class="oc-height-1-1 oc-width-1-1">
     <form :action="appUrl" target="app-iframe" method="post">
@@ -18,6 +19,7 @@
       class="oc-width-1-1 oc-height-1-1"
       :title="iFrameTitle"
       allowfullscreen
+      sandbox="allow-scripts allow-same-origin"
     />
   </div>
 </template>