Skip to content

[stable35] fix(federation): post messages to the initiator origin from the remote page - #6210

Merged
ArtificialOwl merged 1 commit into
stable35from
backport/6190/stable35
Oct 20, 2026
Merged

ArtificialOwl merged 1 commit into
stable35from
backport/6190/stable35

Conversation

@backportbot

@backportbot backportbot Bot commented Oct 20, 2026

Copy link
Copy Markdown

Backport of PR #6190

…e page

A federated file is edited through /apps/richdocuments/remote on the
instance that owns it, embedded in an iframe on the initiator instance.
Since the origin hardening, document.js sends every message for the
parent window to its own origin. In this case the parent is the
initiator, so the browser drops them all, including UI_Close: the
viewer on the initiator stays open over an empty page.

Pass the origin of the initiator to the page. The remote endpoint only
renders after the initiator passed the trusted server check and its
token was confirmed, so the value is verified. Messages from that
origin are accepted as well, so the initiator can still talk to the
editor.

Fixes #6094

Signed-off-by: Rikdekker <Rikdekker@users.noreply.github.com>
Assisted-by: ClaudeCode:claude-opus-5-5
@backportbot
backportbot Bot requested a review from Rikdekker October 20, 2026 12:05
@backportbot backportbot Bot added bug Something isn't working 3. to review Ready to be reviewed labels Oct 20, 2026
@ArtificialOwl
ArtificialOwl merged commit 5a19671 into stable35 Oct 20, 2026
58 checks passed
@ArtificialOwl
ArtificialOwl deleted the backport/6190/stable35 branch October 20, 2026 12:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Ready to be reviewed bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants