Remove sandbox for apps (#11175)

owncloud · Jul 11, 2024 · bd10ab8 · bd10ab8
1 parent 60459c4
commit bd10ab8
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 5 deletions.
diff --git a/packages/web-app-draw-io/src/App.vue b/packages/web-app-draw-io/src/App.vue
@@ -4,7 +4,6 @@
     ref="drawIoEditor"
     :src="iframeSource"
     :title="$gettext('Draw.io editor')"
-    sandbox="allow-scripts allow-same-origin"
   />
 </template>
 

diff --git a/packages/web-app-external/src/App.vue b/packages/web-app-external/src/App.vue
@@ -5,7 +5,6 @@
     class="oc-width-1-1 oc-height-1-1"
     :title="iFrameTitle"
     allowfullscreen
-    sandbox="allow-scripts allow-same-origin"
   />
   <div v-if="appUrl && method === 'POST' && formParameters" class="oc-height-1-1 oc-width-1-1">
     <form :action="appUrl" target="app-iframe" method="post">
@@ -19,7 +18,6 @@
       class="oc-width-1-1 oc-height-1-1"
       :title="iFrameTitle"
       allowfullscreen
-      sandbox="allow-scripts allow-same-origin"
     />
   </div>
 </template>

diff --git a/packages/web-app-external/tests/unit/__snapshots__/app.spec.ts.snap b/packages/web-app-external/tests/unit/__snapshots__/app.spec.ts.snap
@@ -1,7 +1,7 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`The app provider extension > should be able to load an iFrame via get 1`] = `
-"<iframe src="https://example.test/d12ab86/loe009157-MzBw" class="oc-width-1-1 oc-height-1-1" title="" example-app" app content area" allowfullscreen="" sandbox="allow-scripts allow-same-origin"></iframe>
+"<iframe src="https://example.test/d12ab86/loe009157-MzBw" class="oc-width-1-1 oc-height-1-1" title="" example-app" app content area" allowfullscreen=""></iframe>
 
 <!--v-if-->"
 `;
@@ -13,7 +13,7 @@ exports[`The app provider extension > should be able to load an iFrame via post
   <form action="https://example.test/d12ab86/loe009157-MzBw" target="app-iframe" method="post"><input type="submit" class="oc-hidden" value="[object Object]">
     <div><input name="access_token" type="hidden" value="asdfsadfsadf"></div>
     <div><input name="access_token_ttl" type="hidden" value="123456"></div>
-  </form> <iframe name="app-iframe" class="oc-width-1-1 oc-height-1-1" title="" example-app" app content area" allowfullscreen="" sandbox="allow-scripts allow-same-origin"></iframe>
+  </form> <iframe name="app-iframe" class="oc-width-1-1 oc-height-1-1" title="" example-app" app content area" allowfullscreen=""></iframe>
 </div>"
 `;