prevent loading render.js and rsvp.js twice from different url
Patch for spreadsheet gadget works in classic erp5 standard ui too and for @jerome gadget works in renderjs_ui as well as in erp5 standard ui.
-
OwnerURL are meaningless and only describe location of a ressource.
It is possible to host renderjs in a server with a completely different kind of URL (shacache for example) and this patch will not prevent conflict to happen.
For now, I consider the application developper should be responsible to prevent such issue. RenderJS can not alone prevent it currently.
One easy way is to embed the "uncontrolled" into an iframe sandbox. This will prevent any conflict.
A cleaner but more difficult solution would be to start using SRI and handle it also in renderJS. But I'm afraid of updating all gadget HTML when renderJS is updated. We could start using ERP5 template functionnality to calculate the SHA dynamically.
In short, I reject the merge request.
-
Status changed to closed
Toggle commit list -
