Only allow iframe embedding

2019-03-20 17:51:32 +00:00
parent 5270553f27
commit 956e064c8c
1 changed files with 5 additions and 0 deletions
--- a/src/components/App/client-api.ts
+++ b/src/components/App/client-api.ts
@@ -9,6 +9,11 @@ export interface ReadyMessage {
 }

 export function exposeAPI(app: App) {
+  if (window === top) {
+    // Someone opened Squoosh in a window rather than an iframe.
+    // This can be deceiving and we won’t allow that.
+    return;
+  }
  self.parent.postMessage({ type: 'READY', version: MAJOR_VERSION }, '*');
  self.addEventListener('message', (event: MessageEvent) => {
    if (event.data !== 'READY?') {