Getting "Download is Disallowed" in iframe. #2421

New Issue

OVERLORD · 2026-02-05T04:05:32+03:00

OVERLORD commented

2026-02-05 04:05:32 +03:00

Originally created by @joe-eklund on GitHub (Oct 9, 2021).

Describe the bug
I have attached a file to a particular page. When I attempt to download the file while using Bookstack in an iframe I get this error in my console and the file does not download:

Download is disallowed. The frame initiating or instantiating the download is sandboxed, but the flag ‘allow-downloads’ is not set. See https://www.chromestatus.com/feature/5706745674465280 for more details.

Steps To Reproduce

Browse to Bookstack in an iframe.
Upload a file to a page.
Attempt to download the file. It will not work and you will get the above error.
Attempt to download the file again while browsing not in an iframe. It works just fine.

Expected behavior
I should be able to download files while browsing Bookstack in an iframe.

Your Configuration (please complete the following information):

Exact BookStack Version (Found in settings): BookStack v21.05.4.
PHP Version:
Hosting Method (Nginx/Apache/Docker): Docker on Ubuntu.

Additional context
I'm not quite sure if this is a bug or some other configuration change I need to make. I have also already set the - ALLOWED_IFRAME_HOSTS="my_domain" environment variable in my docker compose. Testing the downloading in Chrome on Windows.

Any help on this would be greatly appreciated. Thanks!

Originally created by @joe-eklund on GitHub (Oct 9, 2021). **Describe the bug** I have attached a file to a particular page. When I attempt to download the file while using Bookstack in an iframe I get this error in my console and the file does not download: ``` Download is disallowed. The frame initiating or instantiating the download is sandboxed, but the flag ‘allow-downloads’ is not set. See https://www.chromestatus.com/feature/5706745674465280 for more details. ``` **Steps To Reproduce** 1. Browse to Bookstack in an iframe. 2. Upload a file to a page. 3. Attempt to download the file. It will not work and you will get the above error. 4. Attempt to download the file again while browsing _not_ in an iframe. It works just fine. **Expected behavior** I should be able to download files while browsing Bookstack in an iframe. **Your Configuration (please complete the following information):** - Exact BookStack Version (Found in settings): BookStack v21.05.4. - PHP Version: - Hosting Method (Nginx/Apache/Docker): Docker on Ubuntu. **Additional context** I'm not quite sure if this is a bug or some other configuration change I need to make. I have also already set the `- ALLOWED_IFRAME_HOSTS="my_domain"` environment variable in my docker compose. Testing the downloading in Chrome on Windows. Any help on this would be greatly appreciated. Thanks!

OVERLORD closed this issue

2026-02-05 04:05:33 +03:00

OVERLORD commented

2026-02-05 04:05:38 +03:00

@ssddanbrown commented on GitHub (Oct 9, 2021):

Hi @joe-eklund,
Getting downloads to work here requires a change in the way the iframe is defined on the site that's embedding BookStack. The sandbox attribute of the iframe needs to be updated with allow-downloads. I don't think this is something that can be solved from the BookStack side of things.

@ssddanbrown commented on GitHub (Oct 9, 2021): Hi @joe-eklund, Getting downloads to work here requires a change in the way the iframe is defined on the site that's embedding BookStack. The sandbox attribute of the iframe needs to be updated with `allow-downloads`. I don't think this is something that can be solved from the BookStack side of things.

OVERLORD commented

2026-02-05 04:05:42 +03:00

@joe-eklund commented on GitHub (Oct 11, 2021):

Hmm ok. I am iFraming it inside Organizr with both being Traefik 1.7 as a reverse proxy. I am planning on upgrading to Traefik 2 soon.

I attempted to set the contentSecurityPolicy with sandbox allow-downloads for Bookstack using Traefik labels but that didn't seem to affect it. I will continue to investigate how this is possible, but if anyone has this working I would very much like to know.

@joe-eklund commented on GitHub (Oct 11, 2021): Hmm ok. I am iFraming it inside Organizr with both being Traefik 1.7 as a reverse proxy. I am planning on upgrading to Traefik 2 soon. I attempted to set the `contentSecurityPolicy` with `sandbox allow-downloads` for Bookstack using Traefik labels but that didn't seem to affect it. I will continue to investigate how this is possible, but if anyone has this working I would very much like to know.

OVERLORD commented

2026-02-05 04:05:46 +03:00

@ssddanbrown commented on GitHub (Oct 11, 2021):

@joe-eklund The allow-downloads flag will need to be set on the iframe element itself. This is not something to be done at proxy level but is likely Organizr in this case.

I am not familiar with Organizr in any way but I presume this is how it builds the iframe:

8f00d1322c/js/functions.js (L2844)

It looks like the sandbox properties are dynamic. When configuring your BookStack setup in Orgranizr, does it provide any kind of "Sandbox" or "Iframe" options within the UI?

@ssddanbrown commented on GitHub (Oct 11, 2021): @joe-eklund The `allow-downloads` flag will need to be set on the iframe element itself. This is not something to be done at proxy level but is likely Organizr in this case. I am not familiar with Organizr in any way but I presume this is how it builds the iframe: https://github.com/causefx/Organizr/blob/8f00d1322c2c9ee88c80c36254071317ccad0267/js/functions.js#L2844 It looks like the sandbox properties are dynamic. When configuring your BookStack setup in Orgranizr, does it provide any kind of "Sandbox" or "Iframe" options within the UI?

OVERLORD commented

2026-02-05 04:05:48 +03:00

@joe-eklund commented on GitHub (Oct 12, 2021):

@ssddanbrown Thank you so much for your help. You are correct! I added it through the organizr UI to the sandbox section and it worked!

For anyone else that wants to do this go to Organizr Settings > Main > Security > Sandbox and add Allow Downloads to the list. You can now download files from iFrames. :)

@joe-eklund commented on GitHub (Oct 12, 2021): @ssddanbrown Thank you so much for your help. You are correct! I added it through the organizr UI to the sandbox section and it worked! For anyone else that wants to do this go to Organizr Settings > Main > Security > Sandbox and add `Allow Downloads` to the list. You can now download files from iFrames. :)

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2421