From c97503ab7cb04bb0c883a28887e869b385b0d51e Mon Sep 17 00:00:00 2001
From: zubiden <19638254+zubiden@users.noreply.github.com>
Date: Tue, 14 Apr 2026 17:23:48 +0200
Subject: [PATCH] Mini App: Bring back `allow-same-origin` (#6852)

---
 eslint.config.js                                       | 2 ++
 src/components/main/GameModal.tsx                      | 2 +-
 src/components/modals/webApp/WebAppModalTabContent.tsx | 1 +
 src/components/payment/ConfirmPayment.tsx              | 2 +-
 4 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/eslint.config.js b/eslint.config.js
index 8cf5eb0d8..6facc4f9b 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -206,6 +206,8 @@ export default defineConfig(
       '@eslint-react/no-missing-key': 'off',
       '@eslint-react/no-nested-component-definitions': 'off',
       '@eslint-react/no-unused-props': 'off',
+      '@eslint-react/dom-no-unsafe-iframe-sandbox': 'off',
+      '@eslint-react/dom/no-unsafe-iframe-sandbox': 'off',
       '@eslint-react/no-leaked-conditional-rendering': 'error',
     },
     plugins: {
diff --git a/src/components/main/GameModal.tsx b/src/components/main/GameModal.tsx
index bfe55db29..b8b7fa551 100644
--- a/src/components/main/GameModal.tsx
+++ b/src/components/main/GameModal.tsx
@@ -81,7 +81,7 @@ const GameModal: FC<OwnProps & StateProps> = ({ openedGame, gameTitle, canPost }
           onLoad={handleLoad}
           src={url}
           title={lang('AttachGame')}
-          sandbox="allow-scripts allow-orientation-lock"
+          sandbox="allow-scripts allow-same-origin allow-orientation-lock"
           allow="fullscreen"
         />
       )}
diff --git a/src/components/modals/webApp/WebAppModalTabContent.tsx b/src/components/modals/webApp/WebAppModalTabContent.tsx
index b4ede2fe2..e9f81bc79 100644
--- a/src/components/modals/webApp/WebAppModalTabContent.tsx
+++ b/src/components/modals/webApp/WebAppModalTabContent.tsx
@@ -97,6 +97,7 @@ const SANDBOX_ATTRIBUTES = [
   'allow-popups',
   'allow-forms',
   'allow-modals',
+  'allow-same-origin',
   'allow-storage-access-by-user-activation',
 ].join(' ');
 
diff --git a/src/components/payment/ConfirmPayment.tsx b/src/components/payment/ConfirmPayment.tsx
index 281ec85a9..c67428f99 100644
--- a/src/components/payment/ConfirmPayment.tsx
+++ b/src/components/payment/ConfirmPayment.tsx
@@ -79,7 +79,7 @@ const ConfirmPayment: FC<OwnProps> = ({
         src={url}
         title={lang('Checkout.WebConfirmation.Title')}
         allow="payment"
-        sandbox="allow-modals allow-forms allow-scripts allow-top-navigation"
+        sandbox="allow-modals allow-forms allow-scripts allow-top-navigation allow-same-origin"
         className="ConfirmPayment__content"
       />
     </div>