OTSSigns/OTSSignsTheme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Update login URL construction in layoutauth.html and restrict postMessage targetOrigin in layout-designer-page.twig

Browse Source
This commit is contained in:
Matt Batchelder
2026-04-07 19:37:39 -04:00
parent 9a9ec7661c
commit d1c69404bb
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ots-signs/views/layout-designer-page.twig
View File

@@ -576,8 +576,9 @@
? document.getElementById('layout-editor').getAttribute('data-layout-id')
: null;
// TODO: For production, restrict targetOrigin to your app's domain
var targetOrigin = '*';
// Restrict postMessage to the known React app origin.
// window.location.origin is the CMS origin; the parent app is on the same host.
var targetOrigin = window.location.origin;
/**
* Send a message to the parent window.