Feature iframe permissions (#154)

oat-sa · Jul 19, 2023 · 6ad6104 · 6ad6104
1 parent 859b2b2
commit 6ad6104
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,17 @@
 CHANGELOG
 =========
 
+2.8.0
+-----
+
+* Added support for `autoplay`, `camera`, `display-capture`, `fullscreen`, `microphone` in iframe ResourceLink
+* Fixed Deep Linking URL validation
+
+2.7.0
+-----
+
+* Added support for configurable LTI message TTL via `JWT_TTL` environment variable
+
 2.6.0
 -----
 

diff --git a/config/services.yaml b/config/services.yaml
@@ -8,7 +8,7 @@ parameters:
     application_env: '%env(resolve:APP_ENV)%'
     application_api_key: '%env(resolve:APP_API_KEY)%'
     application_vendors: '%kernel.project_dir%/vendor/composer/installed.php'
-    application_version: '2.7.0'
+    application_version: '2.8.0'
     container.dumper.inline_factories: true
     cache.redis.namespace: '%env(default:cache.redis.namespace.default:REDIS_CACHE_NAMESPACE)%'
     cache.redis.namespace.default: 'devkit'

diff --git a/templates/launch/blocks/deepLinkingItem.html.twig b/templates/launch/blocks/deepLinkingItem.html.twig
@@ -22,7 +22,7 @@
                                     {% endif %}
                                     <dt>Description</dt>
                                     <dd>{{ resource.text }}</dd>
-                                    {% if resource.icon is defined %}
+                                    {% if resource.icon is defined and resource.icon.url is defined %}
                                         <dt>Icon</dt>
                                         <dd><img height="20px" width="20px" src="{{ resource.icon.url }}"/></dd>
                                     {% endif %}

diff --git a/templates/platform/message/ltiResourceLinkLaunch.html.twig b/templates/platform/message/ltiResourceLinkLaunch.html.twig
@@ -266,7 +266,10 @@
         $('#launch-in-iframe').click(function () {
             $(this).closest('.card').find('.card-body').replaceWith(
                 $('<div>').addClass('card-body embed-responsive embed-responsive-16by9').append(
-                    $('<iframe>').addClass('embed-responsive-item').attr('src', $(this).data('url'))
+                    $('<iframe>').addClass('embed-responsive-item').attr({
+                        src: $(this).data('url'),
+                        allow: 'autoplay *;camera *;display-capture *;fullscreen* ;microphone *'
+                    })
                 )
             );
         });