Repository navigation
fix(preview): Only exchange messages with the preview frame - #4430
Merged
Merged
Conversation
The admin posted to the preview with "*" and accepted messages from any window, so any frame or opener could focus element editors and every page loaded into the preview received the messages. Taking the target origin from the preview's ready message keeps this working when the frontend lives on another origin or redirects, without trusting other senders.
✅ Deploy Preview for alchemy-guides canceled.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4430 +/- ##
=======================================
Coverage 98.41% 98.41%
=======================================
Files 371 371
Lines 9845 9845
=======================================
Hits 9689 9689
Misses 156 156
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
mamhoff
approved these changes
Oct 30, 2026
💔 All backports failed
Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation and see the Github Action logs for details |
Collaborator
💚 All backports created successfully
Questions ?Please refer to the Backport tool documentation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this pull request for?
The admin posted messages to the preview frame with
"*"as target origin and acceptedAlchemy.focusElementEditorandAlchemy.previewReadymessages from any window. Any page loaded into the preview frame received the admin's messages, and any other frame or opener could focus element editors.The admin now only handles messages whose source is the preview frame, and posts to the origin the preview reported in its
Alchemy.previewReadymessage instead of"*". Taking the origin from that message instead of the iframe'ssrckeeps this working when the frontend lives on another origin (e.g. a headless frontend configured aspreview.host) or redirects (apex towww, http to https). Nothing is sent before the preview reported ready, since there is nobody listening yet.The preview script itself already posts to and accepts messages from its own origin, so the Rails preview is unaffected.
Checklist