Kraut.World/server
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cowebsite opened by script can use Iframe Api

Browse source
This commit is contained in:
GRL 2021-06-28 18:00:48 +02:00
parent 49d627ca38
commit 389ca25b6a
10 changed files with 149 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
maps/tests/Metadata/cowebsiteAllowApi.html Normal file
View file

@ -0,0 +1,17 @@
<!doctype html>
<html lang="en">
<head>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.chat.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
})
</script>
</head>
<body>
</body>
</html>