Sandbox toot embeds in the embed modal

It should not be necessary thanks to our Content Security Policy, but best be sure in case a server's CSP is incorrect. Also, avoids a CSP warning about loading remote scripts.
2018-12-17 21:42:18 +01:00 · 2018-12-17 21:42:18 +01:00 · 36d27e2891
parent 30de4e4dfc
commit 36d27e2891
1 changed files with 1 additions and 0 deletions
--- a/app/javascript/flavours/glitch/features/ui/components/embed_modal.js
+++ b/app/javascript/flavours/glitch/features/ui/components/embed_modal.js
@ -74,6 +74,7 @@ export default class EmbedModal extends ImmutablePureComponent {
            className='embed-modal__iframe'
            frameBorder='0'
            ref={this.setIframeRef}
+            sandbox='allow-same-origin'
            title='preview'
          />
        </div>