馃 Allow forms in page extension iframes, so CKEditor in an extension can add links

Fons Vandammerequested to merge
issue/canvas-3591911:3591911-ckeditor-links-fail-due-to-missing-allow-forms-in-extensionpage-iframe-sandbox into 1.x

Closes #3591911

  • Add allow-forms to the page extension iframe sandbox. CKEditor's link balloon is a form, so extensions using CKEditor (e.g. Canvas Translate) cannot add links. Based on the patch by @jorisclaes.
  • Add allow-popups and allow-popups-to-escape-sandbox, so target="_blank" links in extensions open, and the opened page is not sandboxed. Separate commit. Use case: canvas_translate #3621911.
  • Update the sandboxing section in packages/extensions/README.md, with an empty changeset.

Testing

  • In a page extension using CKEditor, add a link: it is applied.
  • Open that link from the editor: it opens in a new tab.

AI-Generated: Partially (Claude Code prepared the MR from the patch; tested manually by the author.)

Closes #3591911

Merge request reports