Viewing 6 posts - 1 through 6 (of 6 total)
  • Author
    Posts
  • November 25, 2024 at 10:14 pm #1472196
    timothym49

    I have an iframe with an embedded Google map that when placed in a standalone HTML file renders with no problem. If I place the same iframe into a page on my recently updated Enfold site, it does not render, though you can see the exact same iframe in the HTML sources. Can you help me identify where the problem lies?

    November 28, 2024 at 9:39 am #1472452
    Ismael

    Hey timothym49,

    Thank you for the inquiry.

    You may need to disable the default Google Map implementation in the theme by adjusting the Enfold > Google Services > Enable Google Maps on your site settings. Please let us know once the site is live so that we can check the elements.

    Best regards,
    Ismael

    December 3, 2024 at 7:05 pm #1472808
    timothym49
    This reply has been marked as private.
    December 4, 2024 at 9:54 am #1472864
    Ismael

    Hi,

    Thank you for the update.

    The map seems to be displaying correctly on the contact page, as shown in the screenshot below (see private field). Did you manage to resolve the issue? If not, please provide the login details in the private field so we can investigate further.

    Best regards,
    Ismael

    December 4, 2024 at 10:18 pm #1472954
    timothym49

    This issue was found to be caused by nginx Content-Security-Policy settings, which became apparent when viewing Javascript errors in the developer console.

    December 4, 2024 at 11:06 pm #1472955
    Guenni007

    do you have influence on those settings?

    on my apache servers i do set this via htaccess file
    f.e.

    <IfModule mod_headers.c>
Header set X-Frame-Options "sameorigin"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set Content-Security-Policy "upgrade-insecure-requests"
Header set Cross-Origin-Embedder-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy "same-origin"
Header set Cross-Origin-Resource-Policy: "same-site"
Header always set Permissions-Policy "geolocation=(), midi=(),sync-xhr=(),accelerometer=(), gyroscope=(), magnetometer=(), camera=(), fullscreen=(self)"
</IfModule>

    Results can be checked here f.e.: https://securityheaders.com/?q=guenterweber.com&followRedirects=on

  • Author
    Posts
Viewing 6 posts - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.