From 4b1bd10c519f45571d3d7c013cb86603cfe0fb04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Thu, 4 Apr 2024 09:33:48 +0200
Subject: [PATCH] fix: apply sandbox attribute to OnlyOffice/Collabora iframe

---
 packages/web-app-external/src/App.vue | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/web-app-external/src/App.vue b/packages/web-app-external/src/App.vue
index cb58bab7bf8..a68e5bb7ff2 100644
--- a/packages/web-app-external/src/App.vue
+++ b/packages/web-app-external/src/App.vue
@@ -5,6 +5,7 @@
     class="oc-width-1-1 oc-height-1-1"
     :title="iFrameTitle"
     allowfullscreen
+    sandbox="allow-scripts allow-same-origin"
   />
   <div v-if="appUrl && method === 'POST' && formParameters" class="oc-height-1-1 oc-width-1-1">
     <form :action="appUrl" target="app-iframe" method="post">
@@ -18,6 +19,7 @@
       class="oc-width-1-1 oc-height-1-1"
       :title="iFrameTitle"
       allowfullscreen
+      sandbox="allow-scripts allow-same-origin"
     />
   </div>
 </template>