From 4ca3f5ca023c759394e618bb75781ad5f9b9faa2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnter=20Obiltschnig?= <guenter.obiltschnig@appinf.com>
Date: Fri, 1 Apr 2022 12:20:22 +0200
Subject: [PATCH] #3500: Sandbox all iFrames in PocoDoc

---
 PocoDoc/resources/index.thtml | 2 +-
 PocoDoc/src/DocWriter.cpp     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/PocoDoc/resources/index.thtml b/PocoDoc/resources/index.thtml
index 0583b3500..f568ed1c6 100644
--- a/PocoDoc/resources/index.thtml
+++ b/PocoDoc/resources/index.thtml
@@ -16,7 +16,7 @@ ${PocoDoc.customHeadHTML}
 </div>
 <div class="body">
 <div id="navigation">
-<iframe src="navigation.html" onload="iFrameResize(this);" scrolling="no"></iframe>
+<iframe sandbox src="navigation.html" onload="iFrameResize(this);" scrolling="no"></iframe>
 </div>
 <div id="content">
 <h2>User Guides And Tutorials</h2>
diff --git a/PocoDoc/src/DocWriter.cpp b/PocoDoc/src/DocWriter.cpp
index d6d1b6bf8..dbe382d02 100644
--- a/PocoDoc/src/DocWriter.cpp
+++ b/PocoDoc/src/DocWriter.cpp
@@ -808,7 +808,7 @@ void DocWriter::writeNavigationFrame(std::ostream& ostr, const std::string& grou
 		query += item;
 	}
 	ostr << "<div id=\"navigation\">\n";
-	ostr << "<iframe src=\"navigation.html" << query << "\" onload=\"iFrameResize(this);\" scrolling=\"no\"></iframe>\n";
+	ostr << "<iframe sandbox src=\"navigation.html" << query << "\" onload=\"iFrameResize(this);\" scrolling=\"no\"></iframe>\n";
 	ostr << "</div>\n";
 }