From 77540346413259e4ec62ee8302e503bcd2a01047 Mon Sep 17 00:00:00 2001
From: Rigel Kent <sendmemail@rigelk.eu>
Date: Sun, 10 Jun 2018 18:20:19 +0200
Subject: (embed) sandbox the iframe

---
 server/controllers/services.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'server/controllers')

diff --git a/server/controllers/services.ts b/server/controllers/services.ts
index a58a5b8cf..1f82db9c4 100644
--- a/server/controllers/services.ts
+++ b/server/controllers/services.ts
@@ -45,7 +45,7 @@ function generateOEmbed (req: express.Request, res: express.Response, next: expr
     thumbnailUrl = undefined
   }
 
-  const html = `<iframe width="${embedWidth}" height="${embedHeight}" src="${embedUrl}" frameborder="0" allowfullscreen></iframe>`
+  const html = `<iframe width="${embedWidth}" height="${embedHeight}" sandbox="allow-same-origin allow-scripts" src="${embedUrl}" frameborder="0" allowfullscreen></iframe>`
 
   const json: any = {
     type: 'video',
-- 
cgit v1.2.3