Use dynamic Iframe API

2021-06-28 16:13:38 +02:00 · 2021-06-28 16:13:38 +02:00 · 06920a2271
commit 06920a2271
parent feab5da2ad
1 changed files with 5 additions and 2 deletions
--- a/maps/tests/Metadata/cowebsiteAllowApi.html
+++ b/maps/tests/Metadata/cowebsiteAllowApi.html
@ -1,9 +1,12 @@
 <!doctype html>
 <html lang="en">
    <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
        <script>
-
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
        </script>
    </head>
    <body>