lbehm/workadventure
1
0
Fork 0
Code Issues Pull requests Releases Activity
workadventure/maps/tests/Metadata/cowebsiteAllowApi.js

2 lines
57 B
JavaScript
Raw Normal View History

Fixed potential injection by switching map container to PHP Some HTML files were importing iframe_api.js automatically by detecting the referrer document. While this was done in a safe way (the map container does not use cookies), it is not a best practice to load a script originating from document.referrer. This PR solves the issue by using PHP to inject the correct domain name in the HTML files.
2021-11-29 19:05:13 +01:00
WA.nav.openCoWebSite("cowebsiteAllowApi.php", true, "");
Reference in a new issue Copy permalink