diff --git a/app/models/embeddable_host.rb b/app/models/embeddable_host.rb index 7c32a828796..447ee6c161a 100644 --- a/app/models/embeddable_host.rb +++ b/app/models/embeddable_host.rb @@ -32,6 +32,9 @@ class EmbeddableHost < ActiveRecord::Base end def self.url_allowed?(url) + # Work around IFRAME reload on WebKit where the referer will be set to the Forum URL + return true if url&.starts_with?(Discourse.base_url) + uri = URI(URI.encode(url)) rescue nil uri.present? && record_for_url(uri).present? end diff --git a/spec/models/embeddable_host_spec.rb b/spec/models/embeddable_host_spec.rb index 700478871cd..2a7f964b533 100644 --- a/spec/models/embeddable_host_spec.rb +++ b/spec/models/embeddable_host_spec.rb @@ -78,6 +78,10 @@ describe EmbeddableHost do expect(EmbeddableHost.url_allowed?('http://eviltrout.com')).to eq(true) expect(EmbeddableHost.url_allowed?('http://discourse.org')).to eq(true) end + + it 'always allow forum own URL' do + expect(EmbeddableHost.url_allowed?(Discourse.base_url)).to eq(true) + end end describe "path_whitelist" do