Skip to content

v0.7.1 - fix attachment loading inside sandboxed preview/embed

Choose a tag to compare

View all tags
@emaxe emaxe released this 13 Sep 15:52
· 17 commits to main since this release
v0.7.1
b6d3979

Fixed

  • Attached files (images, text, and any other type) embedded inside an artifact's own content (<img src>, links, etc.) failed to load or open when viewed through the sandboxed preview/embed iframe (/api/v1/artifacts/:id/preview, /embed/:token), even though the exact same /af/:token URL worked fine opened directly in a browser tab. Two causes: the assetOrigin the artifact's Content-Security-Policy needs to allow media-src/font-src from the file-serving origin was never actually passed by either route, and the sandboxed iframes were missing the allow-downloads token, which browsers require before letting a sandboxed frame initiate any file download (every non-image/video/audio/font attachment is always served as Content-Disposition: attachment).

Full changelog: https://github.com/emaxe/open-artifacts/blob/main/CHANGELOG.md#071---2026-09-13

Assets 2
Loading