From 8baaad2c086e96653964e5390e00bca156ed2218 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leon=20B=C3=B6sche?= Date: Tue, 13 Jan 2026 12:59:49 +0100 Subject: [PATCH] Fix Collabora form submission: remove iframe target and use _self to bypass CSP --- go_cloud/internal/http/wopi_handlers.go | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/go_cloud/internal/http/wopi_handlers.go b/go_cloud/internal/http/wopi_handlers.go index 92d0635..b90c9b2 100644 --- a/go_cloud/internal/http/wopi_handlers.go +++ b/go_cloud/internal/http/wopi_handlers.go @@ -666,7 +666,8 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database. wopiSrc := fmt.Sprintf("https://go.b0esche.cloud/wopi/files/%s?access_token=%s", fileID, accessToken) // Return HTML page with auto-submitting form - // Collabora Online: POST WOPISrc as form data + // The form POSTs to Collabora from within an iframe to work around CSP frame-ancestors restrictions + // The iframe is hosted on the same domain as the embedded page, allowing the POST to complete htmlContent := fmt.Sprintf(` @@ -683,22 +684,18 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database.

Loading Collabora Online...

- - `, collaboraURL, wopiSrc)