Allow more iframe attributes

2 years ago · 7d1803ac82
1 changed files with 1 additions and 1 deletions
--- a/server/modules/rendering/html-security/renderer.js
+++ b/server/modules/rendering/html-security/renderer.js
@ -29,7 +29,7 @@ module.exports = {

      if (config.allowIFrames) {
        allowedTags.push('iframe')
-        allowedAttrs.push('allow')
+        allowedAttrs.push('allow', 'frameborder', 'allowfullscreen')
      }

      input = DOMPurify.sanitize(input, {