Blocked script execution in '<URL>'

[roughnecks]

Hello,

not sure if this came after latest security patch to homarr..
Blocked script execution in '<URL>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

I cannot click anything anymore inside an iframe (widget).

Thanks

[github-actions]

Hi 👋. Thank you for submitting your first issue to Homarr. Please ensure that you've provided all nessesary information. You can use the three dots > Edit button to update your post with additional images and information. Depending on the current volume of requests, the team should get in conact with you shortly.

[Meierschlumpf]

Hey

Sorry for the inconvenience, we'll try to find a better long term solution in the coming week(s)

[manuel-rw]

I have developed a fix that I will push soon:

Sorry, we didn't plan on breaking JavaScript entirely. Personally, I wasn't aware that the sandbox property disables JavaScript also in the content itself.
Starting from 1.0, we will have automated testing in place to ensure that we make less regressions and mistakes.

[roughnecks]

Thanks both 👍

[manuel-rw]

Can you check whether the issue has been resolved for you in the dev docker image? Testing on my side was successful.

[roughnecks]

Can you check whether the issue has been resolved for you in the dev docker image? Testing on my side was successful.

any side-effect I might encounter doing that?
I'm running homarr as the public home of my lil project, you know..

[manuel-rw]

There should be no side effects if you mounted your data correctly (see https://homarr.dev/docs/getting-started/installation#installation ). The image is virtually the same. We simply push changes to dev all the time but release only sporadically to latest whenever we want to release new features.
But as always, making backups is recommended - regardless of what you do.
Don't forget to go back to latest as soon as you're done. Alternatively, you can spin up a second instance with the dev image to reduce risk of downtime, ...

[lorddusk]

Can confirm running :dev: makes it work again.

[manuel-rw]

Thank you, I will then prepare the release. Thanks for the help

[roughnecks]

Works for me too (I just installed new release).