From 12448ab473c08a2c3c873d7ffa2b78e7630dc87a Mon Sep 17 00:00:00 2001 From: Lauri Ojansivu Date: Fri, 8 Apr 2022 18:37:51 +0300 Subject: [PATCH] Removed browser contect policy so that attachments would be visible. Part 2. Thanks to xet7 ! Fixes #4468 --- .meteor/packages | 1 - .meteor/versions | 2 -- server/policy.js | 6 +++--- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/.meteor/packages b/.meteor/packages index e7be1c582..836dad1e2 100644 --- a/.meteor/packages +++ b/.meteor/packages @@ -77,7 +77,6 @@ accounts-password@1.6.2 cfs:gridfs rzymek:fullcalendar momentjs:moment@2.22.2 -browser-policy-framing@1.1.0 mquandalle:moment msavin:usercache # Keep stylus in 1.1.0, because building v2 takes extra 52 minutes. diff --git a/.meteor/versions b/.meteor/versions index 8e372abdf..7c0c0d761 100644 --- a/.meteor/versions +++ b/.meteor/versions @@ -18,8 +18,6 @@ binary-heap@1.0.11 blaze@2.5.0 blaze-tools@1.1.2 boilerplate-generator@1.7.1 -browser-policy-common@1.0.11 -browser-policy-framing@1.1.0 caching-compiler@1.2.2 caching-html-compiler@1.2.0 callback-hook@1.3.0 diff --git a/server/policy.js b/server/policy.js index 331017a8b..2ff261bad 100644 --- a/server/policy.js +++ b/server/policy.js @@ -15,18 +15,18 @@ Meteor.startup(() => { if (process.env.BROWSER_POLICY_ENABLED === 'true') { // Trusted URL that can embed Wekan in iFrame. const trusted = process.env.TRUSTED_URL; - BrowserPolicy.framing.disallow(); + ////BrowserPolicy.framing.disallow(); //Allow inline scripts, otherwise there is errors in browser/inspect/console //BrowserPolicy.content.disallowInlineScripts(); //BrowserPolicy.content.disallowEval(); //BrowserPolicy.content.allowInlineStyles(); //BrowserPolicy.content.allowFontDataUrl(); - BrowserPolicy.framing.restrictToOrigin(trusted); + ////BrowserPolicy.framing.restrictToOrigin(trusted); //BrowserPolicy.content.allowScriptOrigin(trusted); } else { // Disable browser policy and allow all framing and including. // Use only at internal LAN, not at Internet. - BrowserPolicy.framing.allowAll(); + ////BrowserPolicy.framing.allowAll(); }