1. 11 Jul, 2026 1 commit
    • fix(web): allow user-activated top navigation for custom home iframe (#5955) · ca971413
      The custom home page URL iframe only allows allow-forms/allow-popups/
      allow-popups-to-escape-sandbox/allow-scripts, without allow-top-navigation*.
      As a result, target="_top" nav/menu links inside the (admin-configured,
      trusted) embedded page cannot navigate the top-level window on desktop
      browsers, while some mobile browsers still allow it via allow-popups —
      causing inconsistent behavior rather than an intended restriction.
      
      Add allow-top-navigation-by-user-activation so user-clicked top-level
      links work consistently across devices. This token only permits
      user-activated top navigation and does NOT grant same-origin access,
      so it avoids the security concern of allow-same-origin.
      
      Co-authored-by: 贺. <kuang@M1.local>
      Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
      乾L committed
  2. 10 Jul, 2026 12 commits
  3. 09 Jul, 2026 5 commits
  4. 08 Jul, 2026 5 commits
  5. 07 Jul, 2026 16 commits
  6. 06 Jul, 2026 1 commit