9e3443079f
Splits /p/{slug} into a trusted wrapper (HTML with a sandboxed iframe)
and /p/{slug}/raw (the artifact itself, served with Content-Security-Policy:
sandbox). Artifact JS now runs in an opaque origin and can't read admin
cookies or make same-origin credentialed requests to /a/* or /api/*.
Password gating is enforced on both routes so /raw can't be used to bypass
the unlock flow.
19 lines
538 B
HTML
19 lines
538 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>artifact</title>
|
|
<style>
|
|
html, body { margin: 0; padding: 0; height: 100%; background: #fff; }
|
|
iframe { display: block; width: 100%; height: 100vh; border: 0; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<iframe sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-modals"
|
|
src="/p/{{.Slug}}/raw"
|
|
referrerpolicy="no-referrer"
|
|
title="artifact"></iframe>
|
|
</body>
|
|
</html>
|