tree 5c98baf293d346ac0fe4ebefd383d2bf96aa415b
parent 507dd23119e4548574ca825e729ad287a3fef23a
author Marc Kupietz <kupietz@ids-mannheim.de> 1771141392 +0100
committer Helge <stallkamp@ids-mannheim.de> 1777887174 +0200

Restrict allow-same-origin to plugins that actually ARE AND request it

Only grant allow-same-origin sandbox permission to plugins that
explicitly request it AND are hosted on the same origin as the
application. Cross-origin plugins requesting same-origin are denied
with a warning log.

To request same-origin, you need to add this in the local plugin
configurarzin, for example as follows:

```
{
  "name" : "Export",
  "desc" : "Exports Kalamar results",
  "embed" : [{
    "panel" : "result",
    "title" : "exports KWICs and snippets",
    "icon" : "\uf019",
    "classes" : ["button-icon", "plugin" ],
    "onClick" : {
      "action" : "addWidget",
      "template" : "https://korap.ids-mannheim.de/instance/test-docker/plugin/export/export",
      "permissions" : ["forms", "scripts", "downloads", "same-origin" ]
    }
  }]
}
```

Change-Id: Ifcaddc4f39023c4d885921b2d527f5748811c78d