Merge pull request #10702 from owncloud/fix/drawio-iframe-sandbox

fix: apply sandbox attribute to draw-io iframe
owncloud · Apr 3, 2024 · 567973f · 567973f
2 parents bb18889 + c1f4ae6
commit 567973f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/changelog/unreleased/iframe-sandbox-drawio.md b/changelog/unreleased/iframe-sandbox-drawio.md
@@ -0,0 +1,5 @@
+Bugfix: Apply sandbox attribute to iframe in draw-io extension
+
+General hardening of ownCloud Web
+
+https://github.com/owncloud/web/pull/10702
diff --git a/packages/web-app-draw-io/src/App.vue b/packages/web-app-draw-io/src/App.vue
@@ -4,8 +4,10 @@
     ref="drawIoEditor"
     :src="iframeSource"
     :title="$gettext('Draw.io editor')"
+    sandbox="allow-scripts allow-same-origin"
   />
 </template>
+
 <script lang="ts">
 import qs from 'qs'
 import {