cb09a27cc2
Add a class for wrapping arbitrary HTML content in an iframe, with an interface similar to that of OutputPage. The iframe uses 'sandbox="allow-scripts"' (which disallows various actions for scripts executed in the iframe, most notably access to any browser data for the website embedding the iframe), making it suitable for running untrusted scrips. This is a minimal patch to get the a feature in a state where it can be tested in staging. It's not intended for real-world use yet. See P53299 for hooking up the code for manual testing. Soft-depends on I3ce24a1b1d2635ba46d1af1c51dccb292dfdbc55. Bug: T222807 Bug: T169027 Co-Authored-By: Gergő Tisza <tgr.huwiki@gmail.com> Co-Authored-By: C. Scott Ananian <cscott@cscott.net> Change-Id: I658c7f3c751505ce4045047a19f11da1d236cd88
38 lines
749 B
PHP
38 lines
749 B
PHP
<?php
|
|
|
|
namespace MediaWiki\Output;
|
|
|
|
use MediaWiki\Title\TitleFactory;
|
|
use RequestContext;
|
|
use SkinFactory;
|
|
|
|
/**
|
|
* Factory for IframeSandbox objects.
|
|
*/
|
|
class IframeSandboxFactory {
|
|
|
|
private TitleFactory $titleFactory;
|
|
private SkinFactory $skinFactory;
|
|
|
|
public function __construct(
|
|
TitleFactory $titleFactory,
|
|
SkinFactory $skinFactory
|
|
) {
|
|
$this->titleFactory = $titleFactory;
|
|
$this->skinFactory = $skinFactory;
|
|
}
|
|
|
|
/**
|
|
* @param RequestContext $context
|
|
* @return IframeSandbox
|
|
* @internal This approach is still being verified and not ready for general use.
|
|
*/
|
|
public function create( RequestContext $context ): IframeSandbox {
|
|
return new IframeSandbox(
|
|
$this->titleFactory,
|
|
$this->skinFactory,
|
|
$context
|
|
);
|
|
}
|
|
|
|
}
|