From 52b95ad1210e608755142b9ef3abeb6e149fd044 Mon Sep 17 00:00:00 2001
From: Buco7854 <github@grimbert.net>
Date: Wed, 24 Jun 2026 18:21:40 +0000
Subject: [PATCH] fix: keep the admin status page preview iframe same-origin

The preview framed the page public URL, which for a custom domain is cross
origin and blocked by the admin document CSP frame-src. Point the iframe at the
same-origin public path while the frame chrome still shows the public URL.
---
 client/src/Pages/StatusPage/Status/index.tsx |  4 +++-
 client/src/Utils/statusPageUrl.ts            | 10 ++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/client/src/Pages/StatusPage/Status/index.tsx b/client/src/Pages/StatusPage/Status/index.tsx
index 6aed8817b..834228843 100644
--- a/client/src/Pages/StatusPage/Status/index.tsx
+++ b/client/src/Pages/StatusPage/Status/index.tsx
@@ -17,6 +17,7 @@ import {
 } from "@/Types/StatusPage";
 import {
 	buildStatusPageApiPath,
+	getStatusPagePreviewUrl,
 	getStatusPagePublicUrl,
 	isCustomDomainHost,
 } from "@/Utils/statusPageUrl";
@@ -142,6 +143,7 @@ const StatusPageView = () => {
 	}
 
 	const publicUrl = getStatusPagePublicUrl(statusPage);
+	const previewUrl = getStatusPagePreviewUrl(statusPage);
 	return (
 		<BasePage
 			loading={isLoading}
@@ -163,7 +165,7 @@ const StatusPageView = () => {
 				<BrowserFrame url={publicUrl}>
 					<Box
 						component="iframe"
-						src={publicUrl}
+						src={previewUrl}
 						title={t("pages.statusPages.preview.title")}
 						flex={1}
 						width="100%"
diff --git a/client/src/Utils/statusPageUrl.ts b/client/src/Utils/statusPageUrl.ts
index ff19f87c6..d5628d6bc 100644
--- a/client/src/Utils/statusPageUrl.ts
+++ b/client/src/Utils/statusPageUrl.ts
@@ -70,6 +70,16 @@ export const getStatusPagePublicUrl = (
 	return `${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
 };
 
+// Same-origin URL for the admin preview iframe; a custom domain would be cross
+// origin and blocked by the admin document's CSP frame-src.
+export const getStatusPagePreviewUrl = (statusPage: Pick<StatusPage, "url">): string => {
+	if (typeof window !== "undefined") {
+		return `${window.location.origin}${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
+	}
+
+	return `${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
+};
+
 export const buildStatusPageApiPath = (options: {
 	url?: string;
 	useCustomDomain?: boolean;