From 3c66d639e31ba8a7477d337b37d8d671ea2430cf Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sun, 23 Aug 2026 12:33:34 -0400
Subject: [PATCH] refac

---
 src/lib/components/chat/Artifacts.svelte      |  6 ++-
 .../chat/FileNav/FilePreview.svelte           | 12 ++++-
 .../Messages/Citations/CitationModal.svelte   |  9 +++-
 .../chat/Messages/Markdown/HTMLToken.svelte   |  6 ++-
 .../common/InterfaceSettings.svelte           | 54 ++++++++++++++++++-
 src/lib/stores/index.ts                       |  2 +
 6 files changed, 81 insertions(+), 8 deletions(-)

diff --git a/src/lib/components/chat/Artifacts.svelte b/src/lib/components/chat/Artifacts.svelte
index 49cd554984..77f8b22566 100644
--- a/src/lib/components/chat/Artifacts.svelte
+++ b/src/lib/components/chat/Artifacts.svelte
@@ -251,7 +251,11 @@
 									$config?.ui?.iframe_csp ?? ''
 								)}
 								class="w-full border-0 h-full rounded-none"
-								sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
+								sandbox="{($settings?.iframeSandboxAllowScripts ?? true)
+									? 'allow-scripts'
+									: ''}{($settings?.iframeSandboxAllowDownloads ?? true)
+									? ' allow-downloads'
+									: ''}{($settings?.iframeSandboxAllowForms ?? true)
 									? ' allow-forms'
 									: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false)
 									? ' allow-same-origin'
diff --git a/src/lib/components/chat/FileNav/FilePreview.svelte b/src/lib/components/chat/FileNav/FilePreview.svelte
index 02e6e53975..8588c371cc 100644
--- a/src/lib/components/chat/FileNav/FilePreview.svelte
+++ b/src/lib/components/chat/FileNav/FilePreview.svelte
@@ -372,7 +372,11 @@
 			{/if}
 			<iframe
 				src={serveUrl}
-				sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
+				sandbox="{($settings?.iframeSandboxAllowScripts ?? true)
+					? 'allow-scripts'
+					: ''}{($settings?.iframeSandboxAllowDownloads ?? true)
+					? ' allow-downloads'
+					: ''}{($settings?.iframeSandboxAllowForms ?? true)
 					? ' allow-forms'
 					: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}"
 				class="w-full h-full border-none bg-white"
@@ -384,7 +388,11 @@
 			{/if}
 			<iframe
 				srcdoc={injectCsp(fileContent, $config?.ui?.iframe_csp ?? '')}
-				sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
+				sandbox="{($settings?.iframeSandboxAllowScripts ?? true)
+					? 'allow-scripts'
+					: ''}{($settings?.iframeSandboxAllowDownloads ?? true)
+					? ' allow-downloads'
+					: ''}{($settings?.iframeSandboxAllowForms ?? true)
 					? ' allow-forms'
 					: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}"
 				class="w-full h-full border-none bg-white"
diff --git a/src/lib/components/chat/Messages/Citations/CitationModal.svelte b/src/lib/components/chat/Messages/Citations/CitationModal.svelte
index a259beef11..57ea654364 100644
--- a/src/lib/components/chat/Messages/Citations/CitationModal.svelte
+++ b/src/lib/components/chat/Messages/Citations/CitationModal.svelte
@@ -215,8 +215,13 @@
 							{#if document.metadata?.html}
 								<iframe
 									class="w-full border-0 h-auto rounded-none"
-									sandbox="allow-scripts allow-forms{($settings?.iframeSandboxAllowSameOrigin ??
-									false)
+									sandbox="{($settings?.iframeSandboxAllowScripts ?? true)
+										? 'allow-scripts'
+										: ''}{($settings?.iframeSandboxAllowForms ?? true)
+										? ' allow-forms'
+										: ''}{($settings?.iframeSandboxAllowDownloads ?? true)
+										? ' allow-downloads'
+										: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false)
 										? ' allow-same-origin'
 										: ''}"
 									srcdoc={injectCsp(document.document, $config?.ui?.iframe_csp ?? '')}
diff --git a/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte b/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
index 55a62e6802..e5eb83b81d 100644
--- a/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
+++ b/src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
@@ -109,7 +109,11 @@
 				src={`${WEBUI_BASE_URL}/api/v1/files/${fileId}/content/html`}
 				title="Content"
 				frameborder="0"
-				sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
+				sandbox="{($settings?.iframeSandboxAllowScripts ?? true)
+					? 'allow-scripts'
+					: ''}{($settings?.iframeSandboxAllowDownloads ?? true)
+					? ' allow-downloads'
+					: ''}{($settings?.iframeSandboxAllowForms ?? true)
 					? ' allow-forms'
 					: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}"
 				referrerpolicy="strict-origin-when-cross-origin"
diff --git a/src/lib/components/common/InterfaceSettings.svelte b/src/lib/components/common/InterfaceSettings.svelte
index d6fdf1be7c..72c7066b9f 100644
--- a/src/lib/components/common/InterfaceSettings.svelte
+++ b/src/lib/components/common/InterfaceSettings.svelte
@@ -104,8 +104,10 @@
 
 	let webSearch: string | null = null;
 
+	let iframeSandboxAllowScripts = true;
 	let iframeSandboxAllowSameOrigin = false;
-	let iframeSandboxAllowForms = false;
+	let iframeSandboxAllowForms = true;
+	let iframeSandboxAllowDownloads = true;
 
 	let showManageFloatingActionButtonsModal = false;
 	let showManageImageCompressionModal = false;
@@ -302,8 +304,10 @@
 		userLocation = currentSettings?.userLocation ?? false;
 		showChatTitleInTab = currentSettings?.showChatTitleInTab ?? true;
 
+		iframeSandboxAllowScripts = currentSettings?.iframeSandboxAllowScripts ?? true;
 		iframeSandboxAllowSameOrigin = currentSettings?.iframeSandboxAllowSameOrigin ?? false;
-		iframeSandboxAllowForms = currentSettings?.iframeSandboxAllowForms ?? false;
+		iframeSandboxAllowForms = currentSettings?.iframeSandboxAllowForms ?? true;
+		iframeSandboxAllowDownloads = currentSettings?.iframeSandboxAllowDownloads ?? true;
 
 		stylizedPdfExport = currentSettings?.stylizedPdfExport ?? true;
 
@@ -1531,6 +1535,29 @@
 				</p>
 			</div>
 
+			<div>
+				<div class={settingRowClass}>
+					<div id="iframe-sandbox-allow-scripts-label" class={settingLabelClass}>
+						{$i18n.t('iframe Sandbox Allow Scripts')}
+					</div>
+
+					<div class={settingControlClass}>
+						<Switch
+							ariaLabelledbyId="iframe-sandbox-allow-scripts-label"
+							tooltip={true}
+							bind:state={iframeSandboxAllowScripts}
+							inherited={isDefaultSetting('iframeSandboxAllowScripts')}
+							on:change={() => {
+								saveSettings({ iframeSandboxAllowScripts });
+							}}
+						/>
+					</div>
+				</div>
+				<p class={settingDescriptionClass}>
+					{$i18n.t('Allow scripts inside sandboxed iframes.')}
+				</p>
+			</div>
+
 			<div>
 				<div class={settingRowClass}>
 					<div id="iframe-sandbox-allow-same-origin-label" class={settingLabelClass}>
@@ -1577,6 +1604,29 @@
 				</p>
 			</div>
 
+			<div>
+				<div class={settingRowClass}>
+					<div id="iframe-sandbox-allow-downloads-label" class={settingLabelClass}>
+						{$i18n.t('iframe Sandbox Allow Downloads')}
+					</div>
+
+					<div class={settingControlClass}>
+						<Switch
+							ariaLabelledbyId="iframe-sandbox-allow-downloads-label"
+							tooltip={true}
+							bind:state={iframeSandboxAllowDownloads}
+							inherited={isDefaultSetting('iframeSandboxAllowDownloads')}
+							on:change={() => {
+								saveSettings({ iframeSandboxAllowDownloads });
+							}}
+						/>
+					</div>
+				</div>
+				<p class={settingDescriptionClass}>
+					{$i18n.t('Allow downloads inside sandboxed iframes.')}
+				</p>
+			</div>
+
 			<div class={sectionHeadingClass}>{$i18n.t('Voice')}</div>
 
 			<div>
diff --git a/src/lib/stores/index.ts b/src/lib/stores/index.ts
index 9277a30d0b..cace9cf239 100644
--- a/src/lib/stores/index.ts
+++ b/src/lib/stores/index.ts
@@ -245,8 +245,10 @@ type Settings = {
 	splitLargeChunks?(body: any, splitLargeChunks: any): unknown;
 	backgroundImageUrl?: null;
 	landingPageMode?: string;
+	iframeSandboxAllowScripts?: boolean;
 	iframeSandboxAllowForms?: boolean;
 	iframeSandboxAllowSameOrigin?: boolean;
+	iframeSandboxAllowDownloads?: boolean;
 	scrollOnBranchChange?: boolean;
 	scrollOnResponseGeneration?: boolean;
 	showFilesOnTerminalSelect?: boolean;