Commit graph

7 commits

Author SHA1 Message Date
Eugen Rochko c352ce6f45
Fix missing permission on new embeds making them unclickable (#32135) 2024-09-30 08:20:20 +00:00
Eugen Rochko 3d46f47817
Change embedded posts to use web UI (#31766)
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2024-09-12 09:41:19 +00:00
Renaud Chaput 899eac1a92
Use modern ES syntax rather than .call (#29368) 2024-02-27 15:42:05 +00:00
Matt Hodges 4114a7088a
Embed js height fix (#22141)
* only begin iframe reheight once document state is complete

* format

* lint fixes

* Update public/embed.js to use readystatechange event listener

Co-authored-by: Claire <claire.github-309c@sitedethib.com>

* Call loaded() if ready, otherwise add listenter

* lint fix

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2022-12-15 16:18:59 +01:00
rinsuki 6e736f2452
fix: embed.js doesn't expands iframes height (#18301)
also including some refactoring:
- add `// @ts-check`
- use Map to completely avoid prototype pollution
- assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts
- check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec)

follow-up of #17420
fix #18299
2022-05-04 03:20:44 +02:00
Rohan Sharma 4d6d4b43c6
Fixed prototype pollution bug and only allow trusted origin (#17420) 2022-02-01 17:34:48 +01:00
Eugen Rochko 6867681c7c Add script to make embedded iframes autosize (#4853) 2017-09-09 16:23:44 +02:00