bawnet/integration_gotosocial
4
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Framed client: navigating to any settings page escapes the Nextcloud frame #1

New Issue
Open
opened 2026-08-05 22:17:43 -07:00 by neonoverlord · 0 comments
neonoverlord commented 2026-08-05 22:17:43 -07:00
Member
Copy Link
Copy Source

Repro (Brock, 2026-08-05 night): open the app via the Social menu (framed /app page) -> click any settings entry (General reliably; other settings entries too; the main nav Home/Local/etc does NOT do this) -> the whole window becomes the standalone client (out of the NC frame). Browser Back then flashes a 500 (the stale-classmap redeclare error, separately fixed by post-install graceful reload) before returning to the framed page.

Open questions the next session should answer with devtools:

  • address-bar URL immediately after the escape (top-level nav confirmed or not?)
  • whether Firefox's cannot-display-embedded recovery panel is involved
  • whether sapper's router fallback (component load failure -> location.href) fires for prerendered settings routes, and on WHICH window object

Known-not-the-cause: no target=_top/_parent in settings components; no top/parent refs besides the deliberate OAuth breakout in addInstance.js; CSP frame-ancestors 'self' is set on all served client HTML.

Severity: annoying, not blocking — the standalone client works fine after the escape.

Repro (Brock, 2026-08-05 night): open the app via the Social menu (framed /app page) -> click any settings entry (General reliably; other settings entries too; the main nav Home/Local/etc does NOT do this) -> the whole window becomes the standalone client (out of the NC frame). Browser Back then flashes a 500 (the stale-classmap redeclare error, separately fixed by post-install graceful reload) before returning to the framed page. Open questions the next session should answer with devtools: - address-bar URL immediately after the escape (top-level nav confirmed or not?) - whether Firefox's cannot-display-embedded recovery panel is involved - whether sapper's router fallback (component load failure -> location.href) fires for prerendered settings routes, and on WHICH window object Known-not-the-cause: no target=_top/_parent in settings components; no top/parent refs besides the deliberate OAuth breakout in addInstance.js; CSP frame-ancestors 'self' is set on all served client HTML. Severity: annoying, not blocking — the standalone client works fine after the escape.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
grep neonoverlord (Neon Overlord) securitycenter (Security Center) stormdesk (Storm Desk)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bawnet/integration_gotosocial#1