I have tested this item ✅ successfully on 46a404f

Thank you

Revert broken security fix

It's not broken and it's not a "bug". It's exactly doing what it's supposed to do: it limits the possible actions that an iframe can perform to protect the user from unexpected script execution.

So, the question actually is: does the CMS want to enforce the strictest possible security configuration for the editor, at least by default? Or is the comfort in the content creation process more important?

That's a question that's probably worth a vote in the production department meeting.

I'm for security, of course, but it should at least be possible to embed a local PDF ...
#43407 (comment)

I have tested this item ✅ successfully on 46a404f

RTC

TBH, I have no idea why it is called security,
Crossorigin is not easy to bypass without extra effort, by just embed iframe,
And all local embendings, well, they will be need to be enabled in one or in another way.

We just making life for average User more complicated. They can just switch to codemirror, or none editor, and all this "theorethical security" will disapears.

We are not talking about a CORS but about user experience and perception. Imagine an editor copy&pasting an iframe tag to an external site into the editor window of his companies intranet. On paste, the iframe will be loaded automatically - and without sandboxing, that iframe could i.e. trigger a file download. The user is now under the impression that this download is triggered by a trusted source, which is the Joomla administrator interface of his intranet - whereas the download is actually triggered by the untrusted iframe site.

I'm not necessarily saying, that this is an important threat scenario for the average user, I just want to point out that the issue is not related to crossorigin or samesite policies.

We can make a TinyMCE plugin, that shows an alert for potentialy dangerous iframe (and let User decide what to do), when User insert something in the editor. instead of totaly blocking everything.

Maybe its an option to extend the TinyMCE plugin with the basic configuration for the sandbox parameters so a domain could be added to allow the PDF iframe?

Now with parameter. Ready to test again :)

I have tested this item ✅ successfully on 12ac335

RTC

Thank you @bembelimen and also for testing and review @drmenzelit @SniperSister @RickR2H @Fedik @brianteeman