From ca971413e9a6f64c43f2e016927e1323ea960f40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B9=BEL?= <hekuang857@gmail.com>
Date: Sat, 11 Jul 2026 10:52:17 +0800
Subject: [PATCH] fix(web): allow user-activated top navigation for custom home
 iframe (#5955)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The custom home page URL iframe only allows allow-forms/allow-popups/
allow-popups-to-escape-sandbox/allow-scripts, without allow-top-navigation*.
As a result, target="_top" nav/menu links inside the (admin-configured,
trusted) embedded page cannot navigate the top-level window on desktop
browsers, while some mobile browsers still allow it via allow-popups —
causing inconsistent behavior rather than an intended restriction.

Add allow-top-navigation-by-user-activation so user-clicked top-level
links work consistently across devices. This token only permits
user-activated top navigation and does NOT grant same-origin access,
so it avoids the security concern of allow-same-origin.

Co-authored-by: 贺. <kuang@M1.local>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 web/default/src/features/home/index.tsx | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/web/default/src/features/home/index.tsx b/web/default/src/features/home/index.tsx
index abfc9a29..c157d352 100644
--- a/web/default/src/features/home/index.tsx
+++ b/web/default/src/features/home/index.tsx
@@ -72,12 +72,20 @@ export function Home() {
     if (isUrl) {
       return (
         <PublicLayout showMainContainer={false}>
+          {/*
+            allow-top-navigation-by-user-activation: the custom home page URL is
+            admin-configured (trusted); this lets its target="_top" nav/menu links
+            navigate the top-level window on user click. The default sandbox blocks
+            this on desktop, while some mobile browsers allow it via allow-popups,
+            causing inconsistent behavior. This token only permits user-activated
+            top-level navigation and does NOT grant same-origin access.
+          */}
           <iframe
             ref={iframeRef}
             src={content}
             className='h-screen w-full border-none'
             title={t('Custom Home Page')}
-            sandbox='allow-forms allow-popups allow-popups-to-escape-sandbox allow-scripts'
+            sandbox='allow-forms allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation'
             onLoad={syncIframePreferences}
           />
         </PublicLayout>