Setting sandbox attribute in Embed widget HTML not working as expected

[CatherineRD]

I am using Experience Builder Developer edition 1.15, and have a problem I did not have with version 1.12

I have an embedded app (from a non-ESRI & non-ArcGIS domain) that has built in print functionality (via a button, pop-up & download). As I understand it, the sandbox attribute is set on external apps. I set the sandbox attributes in the Code section of the Embed widget but still the print is not working. I have tried Chrome, Firefox and Edge, but none work.

What I've added to the HTML code :

        sandbox = "allow-forms allow-scripts allow-same-origin allow-popups allow-downloads"

What are the correct settings to allow the print to function? 

[JeffreyThompson2]

The standard Embed Widget is intentionally limited as a security measure. As you are on Developer Edition, your best option would be to build a custom widget that calls in an iframe. Then you can set the security however you want it.

[CatherineRD]

Thankyou, that worked! Although I hard coded the source filename in the widget.tsx, I would prefer to do it through the tool. I imagine I can, I jut haven't worked with custom widgets before. But this gets me a solution until I can look at that.

[JeffreyThompson2]

https://github.com/Esri/arcgis-experience-builder-sdk-resources/tree/master/widgets/demo-function

You can look at this demo widget to see how you can get data from the Settings Panel and use it in a widget, but if you are just building this widget for a single application, I wouldn't bother. Hard-coding is fine.

Also consider that if you plan on sharing this widget in your organization allowing users to add unrestricted iframes could open your organization up to serious security risks.

[ZhujingXia]

Catherine,

Could you share your code which export the attribute info to HTML via sandbox?, where you add this code ?

I'd like to export the attribute info from the Query result and Near Me widget result.

Thank you

Zhujing

[CatherineRD]

Zhujing,

This is the code from the widget.tsx file, the src is the external app that I have in my experience builder web page. This custom widget bypasses the sandbox limitation and the app now works as it should (the print functionality). I'm not sure that is your question - I do not export attribute info. The custom widget replaces the embed widget I was using because I needed to allow the app print functionality to work.

[ZhujingXia]

Thank you so much for sharing.