Mirrors/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-11 04:50:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

enh: allow iframe postMessage prompts without same-origin (with HITL confirmation) (#22908)

Browse Source 
* Update Chat.svelte

* Update Chat.svelte
This commit is contained in:
Classic298
2026-03-22 00:24:24 +01:00
committed by GitHub
parent 93407ba316
commit 0ad448b8a4
1 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/lib/components/chat/Chat.svelte
View File

@@ -569,11 +569,20 @@
origin: string;
data: { type: string; text: string };
}) => {
if (event.origin !== window.origin) {
const isSameOrigin = event.origin === window.origin;
const type = event.data?.type;
// Prompt-related message types only submit text to the chat input —
// functionally equivalent to the user typing. When same-origin is
// enabled they go through immediately. When it is disabled (opaque
// origin) we show a confirmation dialog so the user stays in control.
const iframePromptTypes = ['input:prompt', 'input:prompt:submit', 'action:submit'];
if (!isSameOrigin && !iframePromptTypes.includes(type)) {
return;
}
if (event.data.type === 'action:submit') {
if (type === 'action:submit') {
console.debug(event.data.text);
if (prompt !== '') {
@@ -582,8 +591,7 @@
}
}
// Replace with your iframe's origin
if (event.data.type === 'input:prompt') {
if (type === 'input:prompt') {
console.debug(event.data.text);
const inputElement = document.getElementById('chat-input');
@@ -594,12 +602,26 @@
}
}
if (event.data.type === 'input:prompt:submit') {
if (type === 'input:prompt:submit') {
console.debug(event.data.text);
if (event.data.text !== '') {
await tick();
submitPrompt(event.data.text);
if (isSameOrigin) {
await tick();
submitPrompt(event.data.text);
} else {
// Cross-origin: ask user to confirm before submitting
eventConfirmationInput = false;
eventConfirmationTitle = $i18n.t('Confirm Prompt from Embed');
eventConfirmationMessage = event.data.text;
eventCallback = async (confirmed: boolean) => {
if (confirmed) {
await tick();
submitPrompt(event.data.text);
}
};
showEventConfirmation = true;
}
}
}
};