Comments (11)
Nope - we should run our WASM off the main thread, and do load, rendering etc. in the background; while continuing to render the UI in the main-thread with the same front-end code as now.
from richdocuments.
In that case the header should not be needed as far as @danxuliu told me
from richdocuments.
Hmm - ok ? it seems that we need the parent frame of our iframe to have this @Ashod can you provide more details; quite possibly I've mistaken what's up here I think. Quite possibly our startup WASM runs in the main thread initially (not sure).
from richdocuments.
I believe we need these two headers when serving the parent:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Also had to add script-src unsafe-eval to the CSP header of our frame/js/wasm serving, but we will find out if that is required when we load with the above headers as the missing unsafe-eval was mentioned in the error message.
from richdocuments.
unsafe-eval would be quite an impactful change security wise.
For the others I pushed a quick PR to #3260 which should achieve setting those headers for Nextcloud. However we should of course get more clarify about which headers to add in the end, why and its implications.
from richdocuments.
unsafe-eval sounds bad; but I think we can do that with wasm-eval in future :-) thanks Julius.
from richdocuments.
For the others I pushed a quick PR to #3260 which should achieve setting those headers for Nextcloud. However we should of course get more clarify about which headers to add in the end, why and its implications.
@juliushaertl, I'd like to run some tests locally. Any chance to get the draft PR polished so I can build locally and test?
Thank in advance!
from richdocuments.
@Ashod Pushed and should be testable with that now.
Reference for what it currently set currently set:
from richdocuments.
Thanks @juliushaertl. The PR branch being out-of-date shouldn't be an issue?
@caolanm, does #3260 work for you? Are you able to apply it and build?
from richdocuments.
I have this patched richdocuments and a local nextcloud install. I can see it has an effect, but right now if I open a document, without wasm, then I just get an error of:
[getWopiUrl] http://localhost/nextcloud/index.php/apps/richdocuments/wopi/files/7_oca1b28l9m0b url.js:42:9
The resource at “http://localhost:9980/browser/70f697e3da/cool.html?WOPISrc=http%3A%2F%2Flocalhost%2Fnextcloud%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F7_oca1b28l9m0b&title=%2FDocuments%2FWelcome%20to%20Nextcloud%20Hub.docx&lang=en&closebutton=1&revisionhistory=1” was blocked due to its Cross-Origin-Resource-Policy header (or lack thereof). See https://developer.mozilla.org/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)# files
from richdocuments.
Seems this was caused by those two headers: #3258 (comment)
I pushed a fix up to the PR.
from richdocuments.
Related Issues (20)
- Office usability overview
- Cannot open LibreOffice files via the android app since 3-4 weeks HOT 3
- Error message on editor appereance HOT 3
- Cannot save WOPI allow list when wopi_allowlist setting needs creating HOT 3
- Wrong default date time format. HOT 2
- richdocuments effectively disables ability to open files with Collabora if onlyoffice app is installed HOT 3
- [richdocuments] Error: Failed to fetch the Collabora capabilities endpoint (1000s of occurances) HOT 8
- [Bug]: Long path names break Collabora HOT 3
- Nextcloud app doesn't open Office doc HOT 2
- Comments are broken when editing a document from within Deck 😢 HOT 3
- Renamed document doesn't change name for other users HOT 3
- Global templates cannot be added HOT 2
- iframe lacks allow attribute to use navigator.clipboard in Chrome HOT 1
- "Open file locally" doesn't work HOT 1
- Joining document after it was renamed inside editor causes document conflict and potential data loss
- Default automatic colour styles in nextcloud writer HOT 9
- [Bug]: Unable to uncheck 'restrict usage/edit to specific groups' in Nextcloud Admin Settings HOT 5
- Office files not opening in Android app. Again... HOT 7
- User defined template folder cannot be changed
- Directly redirect to federated URL in direct editing
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from richdocuments.