nextcloud / nextcloud/server

Expose an interface to `$allowedFrameAncestors` in configuration

Open
#25,777 4 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement Nice to have
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are interested into the same feature.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
Can't embed file sharing links as iFrames in other websites due to Content Security Policy.

Describe the solution you'd like
Ideally Nextcloud should expose an interface to $allowedFrameAncestors (ContentSecurityPolicy.php) in configuration.

Describe alternatives you've considered
Right now, I'm manually patching the above file to include the domains I want to embed iFrames on.

Additional context
We're using Nextcloud as an easy way to host PDFs/etc as part of a larger platform, since it's approachable to non-technical content writers.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading ContentSecurityPolicy.php, especially the $allowedFrameAncestors handling, and trace how Nextcloud configuration values are exposed to server code. Determine the existing configuration conventions before assessing the requested interface. Done means administrators can configure allowed frame-ancestor domains without manually patching the file, and those domains are reflected in the Content Security Policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.