From 57c2d72e21be2b3537164e13540a8c59db2239b7 Mon Sep 17 00:00:00 2001
From: Nariman Jelveh <n.jelveh@gmail.com>
Date: Tue, 3 Sep 2024 14:24:58 -0400
Subject: [PATCH] Update UIWindow.js

---
 src/gui/src/UI/UIWindow.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/gui/src/UI/UIWindow.js b/src/gui/src/UI/UIWindow.js
index f495debd..f9069c71 100644
--- a/src/gui/src/UI/UIWindow.js
+++ b/src/gui/src/UI/UIWindow.js
@@ -313,6 +313,9 @@ async function UIWindow(options) {
                 style="${!options.has_head ? ' height: 100%;' : ''}">`;
             // iframe, for apps
             if(options.iframe_url || options.iframe_srcdoc){
+                let allow_str = `camera; encrypted-media; gamepad; display-capture; geolocation; gyroscope; microphone; midi; clipboard-read; clipboard-write; fullscreen;`;
+                if(window.co_isolation_enabled)
+                    allow_str += ' cross-origin-isolated;';
                 // <iframe>
                 // Important: we don't allow allow-same-origin when iframe_srcdoc is used because this would allow the iframe to access the parent window's DOM, localStorage, etc.
                 // this is a security risk and must be avoided.
@@ -323,14 +326,13 @@ async function UIWindow(options) {
                         ${options.iframe_url ? 'src="'+ html_encode(options.iframe_url)+'"' : ''}
                         ${options.iframe_srcdoc ? 'srcdoc="'+ html_encode(options.iframe_srcdoc) +'"' : ''}
                         ${window.co_isolation_enabled
-                            ? 'credentialless allow="cross-origin-isolated" '
+                            ? 'credentialless '
                             : ''
                         }
-                        allow = "accelerometer; camera; encrypted-media; gamepad; display-capture; geolocation; gyroscope; microphone; midi; clipboard-read; clipboard-write; fullscreen;"
+                        allow = "${allow_str}"
                         allowtransparency="true"
                         allowpaymentrequest="true" 
                         allowfullscreen="true"
-                        allow="microphone"
                         webkitallowfullscreen="webkitallowfullscreen" 
                         mozallowfullscreen="mozallowfullscreen"
                         sandbox="allow-forms allow-modals allow-pointer-lock allow-popups allow-popups-to-escape-sandbox ${options.iframe_srcdoc ? '' : 'allow-same-origin'} allow-scripts allow-top-navigation-by-user-activation allow-downloads allow-presentation allow-storage-access-by-user-activation"></iframe>`;