Version 4.7.0

applications/cms/interface/external/external.js

@@ -137,10 +137,10 @@
 		iframe = document.createElement('iframe');
 		iframe.src = _baseURL + '?widgetid=' + widgetID + '&blockid=' + blockID + ( blockParams ? '&' + blockParams : '' );
 		iframe.id = 'ipsFrame_' + widgetID;
-		iframe.scrolling = 'no';
 		iframe.style.width = '100%';
 		iframe.style.border = '0';
 		iframe.style.opacity = '1';
+		iframe.style.overflow = 'hidden';
 
 		// Do we need to probe for some styles
 		if( typeof widgetAttributes['data-inheritstyle'] != 'undefined' ){

applications/cms/interface/external/external.php

@@ -21,11 +21,6 @@ $blockHtml = \IPS\cms\Blocks\Block::display( $id );
 \IPS\Output::i()->jsFiles = array_merge( \IPS\Output::i()->jsFiles, \IPS\Output::i()->js( 'front_external.js', 'cms', 'front' ) );
 \IPS\Output::i()->globalControllers[] = 'cms.front.external.communication';
 
-if( isset( \IPS\Output::i()->httpHeaders['X-Frame-Options'] ) )
-{
-	unset( \IPS\Output::i()->httpHeaders['X-Frame-Options'] );
-}
-
 $cache = FALSE;
 
 try
@@ -34,7 +29,7 @@ try
 	{
 		$block = \IPS\cms\Blocks\Block::load( $id );
 	}
-	else if ( ! $block instanceof \IPS\cms\Blocks\Block )
+	else if ( \is_string( $id ) )
 	{
 		$block = \IPS\cms\Blocks\Block::load( $id, 'block_key' );
 	}
@@ -56,4 +51,13 @@ else
 	$headers = \IPS\Output::getCacheHeaders( time(), \IPS\Settings::i()->widget_cache_ttl );
 }
 
+/* Remove protection headers. This is fine in this case because we only output */
+if( isset( \IPS\Output::i()->httpHeaders['X-Frame-Options'] ) )
+{
+	foreach( [ 'Content-Security-Policy','X-Content-Security-Policy', 'X-Frame-Options' ]  as $toRemove )
+	{
+		unset( \IPS\Output::i()->httpHeaders[$toRemove] );
+	}
+}
+
 \IPS\Output::i()->sendOutput( \IPS\Theme::i()->getTemplate( 'global', 'core' )->blankTemplate( $blockHtml ), 200, 'text/html', $headers );