kentonv / etherpad-lite

Really real-time collaborative document editing for the rest of us
http://etherpad.org
Apache License 2.0
30 stars 11 forks source link

Avoid setting document.domain for CSP sandbox compliance #10

Closed zarvox closed 9 years ago

zarvox commented 9 years ago

The document.domain = document.domain trick appears to only be relevant when using long-polling on a different subdomain or port, which is never the case under Sandstorm. See comment from the author at http://stackoverflow.com/a/1525312

However, this behavior is problematic when CSP sandboxing - the frame is not supposed to be able to modify its origin.

Since Sandstorm does not require this behavior, we remove the lines that cause the app to break when run under a CSP sandbox.