Merge pull request nextcloud#453 from nextcloud/enh/452/set-nonce

Set proper nonce on the outer iframe
proxyconcept · Mar 18, 2019 · d8db33b · d8db33b
2 parents d93b0cc + 16c82f5
commit d8db33b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/js/documents.js b/js/documents.js
@@ -413,7 +413,7 @@ var documentsMain = {
 			  '<input name="access_token" value="' + access_token + '" type="hidden"/></form>';
 
 			// iframe that contains the Collabora Online Viewer
-			var frame = '<iframe id="loleafletframe_viewer" name= "loleafletframe_viewer" style="width:100%;height:100%;position:absolute;"/>';
+			var frame = '<iframe id="loleafletframe_viewer" name="loleafletframe_viewer" nonce="' + btoa(OC.requestToken) + '" style="width:100%;height:100%;position:absolute;"/>';
 
 			$('#revViewer').append(form);
 			$('#revViewer').append(frame);

diff --git a/js/viewer/viewer.js b/js/viewer/viewer.js
@@ -129,7 +129,7 @@ var odfViewer = {
 
 		OC.addStyle('richdocuments', 'mobile');
 
-		var $iframe = $('<iframe id="richdocumentsframe" scrolling="no" allowfullscreen src="'+viewer+'" />');
+		var $iframe = $('<iframe id="richdocumentsframe" nonce="' + btoa(OC.requestToken) + '" scrolling="no" allowfullscreen src="'+viewer+'" />');
 		$.get(OC.generateUrl('/apps/richdocuments/settings/check'), function() {
 			$iframe.src = viewer;
 		}) .fail(function() {