Unable to use Nextcloud Talk in an iframe because of allow attributes

[jejbq]

Organizr Version: V 2.1.2460

Branch: master

WebServer: traefik

Operating System: Debian/Linux

---

Problem Description:

the buildFrame() function in js/functions.js hardcodes the allow attributes, so we can't add a camera and microphone to it as we can for the sandbox in System Settings => Main => Security => iFrame Sandbox

It would therefore be interesting to add an "iFrame Allow" option and use the default "clipboard-read ; clipboard-write" attributes or add the "iFrame allow" option on a case-by-case basis in each Organizr's Tab if the application requires more rights.

Workaround 1: Use "New Windows" instead of "iFrame" in Tab

Workaround 2:

--- organizr/js/functions.js    2024-02-25 01:00:07.310965000 +0100
+++ organizr/js/functions.js    2024-02-28 17:41:19.302195000 +0100
@@ -3108,7 +3108,7 @@
     sandbox = sandbox.replace(/,/gi, ' ');
     sandbox = (sandbox) ? ' sandbox="' + sandbox + '"' : '';
    return `
-       <iframe allow="clipboard-read; clipboard-write" allowfullscreen="true" frameborder="0" id="frame-`+extra+id+`" `+sandbox+` scrolling="auto" src="`+tabInfo.access_url+`" class="iframe"></iframe>
+       <iframe allow="camera; microphone; clipboard-read; clipboard-write" allowfullscreen="true" frameborder="0" id="frame-`+extra+id+`" `+sandbox+` scrolling="auto" src="`+tabInfo.access_url+`" class="iframe"></iframe>
    `;
 }
 function buildFrameContainer(id, split = null){

---

Reproduction Steps:

Set up a Nextcloud AIO with Nextcloud Talk and create a tab in Organizr for https://nextcloud.example.com/apps/spreed/

Nextcloud Talk will not be able to load the camera or microphone even if you set the Permissions-Policy header: camera=(*), microphone=(*) in your reverse proxy.

Permissions-Policy HTTP header, and governs the default behavior if they are not explicitly listed in a policy. These are specified on the individual directive reference pages. For