Skip to content

fix(web): 补全首页 URL iframe 的 sandbox token，修复字体失效与 target=_top 菜单跳转 (#5907) #5909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Heykode wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −1
Open

fix(web): 补全首页 URL iframe 的 sandbox token，修复字体失效与 target=_top 菜单跳转 (#5907) #5909

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion web/default/src/features/home/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,11 +47,21 @@ export function Home() {
if (isUrl) {
return (
<PublicLayout showMainContainer={false}>
{/*
The custom home page URL is admin-configured (trusted).
- allow-same-origin: keep the embedded page's real origin so its own
same-origin resources (notably @font-face fonts) are not treated as
cross-origin and blocked by CORS.
- allow-top-navigation-by-user-activation: let the embedded page's
target="_top" links navigate the top-level window on user click
(e.g. nav/menu links), which the default sandbox otherwise blocks.
This mirrors the existing trusted-iframe usage in web-preview.tsx.
*/}
<iframe
src={content}
className='h-screen w-full border-none'
title={t('Custom Home Page')}
sandbox='allow-forms allow-popups allow-popups-to-escape-sandbox allow-scripts'
sandbox='allow-same-origin allow-top-navigation-by-user-activation allow-forms allow-popups allow-popups-to-escape-sandbox allow-scripts'
/>
</PublicLayout>
)
Expand Down