From 0f31838b35cb64b28bbeee0d32f66aebcd5ef184 Mon Sep 17 00:00:00 2001 From: Rishabh Date: Thu, 27 May 2021 13:39:23 +0530 Subject: [PATCH] Updated target origin to all for portal ready event no refs The purpose of broadcasting portal-ready event is it allows Preview in Admin to have better UX with showing Portal when its ready than show the site while its loading. Having a strict target origin like site url won't work when sites have custom domains as it browser security will block the event due to origin mismatch. Since `portal-ready` is just an event message and doesn't contain any sensitive data that needs to be restricted to origin, this bumps it to `*` which allows any site listening to be able to read the message. --- ghost/portal/src/App.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ghost/portal/src/App.js b/ghost/portal/src/App.js index 23f27f9ac2..6826fd6f71 100644 --- a/ghost/portal/src/App.js +++ b/ghost/portal/src/App.js @@ -75,10 +75,8 @@ export default class App extends React.Component { } sendPortalReadyEvent(siteUrl) { - const siteOrigin = ((new URL(siteUrl)).origin).replace(/\/$/, ''); - if (window.self !== window.parent) { - window.parent.postMessage('portal-ready', siteOrigin); + window.parent.postMessage('portal-ready', '*'); } }