Description
As mentioned in #500 (and #573) sometimes forms want to be embedded in external sites.
To allow it you have to manually update the AllowedFrameAncestorDomain list via:
occ config:app:set appointments "emb_afad_<USER>" --value
<FRAME-ANCESTORS-ENTRY>
Relevant code can be found here:
|
private function setEmbCsp(Response $tr, string $userId): void |
The occ command can only be executed by server admins, which means for a "normale" NC user who created the form it is not possible to share it's forms in an embedded way. To allow it, user should be able to setup the "sharing/embedding" option via the frontend it self.
Security notice: I am not sure, how this feature request would impact the security of NC, because any user may be able to change the CORS frame-ancestors settings. I am not an frontend developer to be honest.
Description
As mentioned in #500 (and #573) sometimes forms want to be embedded in external sites.
To allow it you have to manually update the
AllowedFrameAncestorDomainlist via:Relevant code can be found here:
Appointments/lib/Controller/PageController.php
Line 203 in b300b7b
The
occcommand can only be executed by server admins, which means for a "normale" NC user who created the form it is not possible to share it's forms in an embedded way. To allow it, user should be able to setup the "sharing/embedding" option via the frontend it self.Security notice: I am not sure, how this feature request would impact the security of NC, because any user may be able to change the CORS frame-ancestors settings. I am not an frontend developer to be honest.