From 14fd2758114040d4aa2d49c50f425f1e5a046a7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 12 Jul 2016 14:11:45 +0200
Subject: [PATCH] Use iframe sandbox for rendering HTML in transformation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 .../abstract/FormattedTransformationsPlugin.class.php       | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libraries/plugins/transformations/abstract/FormattedTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/FormattedTransformationsPlugin.class.php
index e6bb8d9ba9..2774167730 100644
--- a/libraries/plugins/transformations/abstract/FormattedTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/FormattedTransformationsPlugin.class.php
@@ -45,7 +45,9 @@ abstract class FormattedTransformationsPlugin extends TransformationsPlugin
      */
     public function applyTransformation($buffer, $options = array(), $meta = '')
     {
-        return $buffer;
+        return '<iframe srcdoc="'
+            . strtr($buffer, '"', '\'')
+            . '" sandbox=""></iframe>';
     }
 
     /**
@@ -77,4 +79,4 @@ abstract class FormattedTransformationsPlugin extends TransformationsPlugin
         return "Formatted";
     }
 }
-?>
\ No newline at end of file
+?>