Allow full display and interaction with Html Emails

[felbus]

Hi,

tldr; how do I load an html email in to a div with caja, allowing the loading of images and clickable links

---

Im just starting to use caja, the API links are down, so am not sure whether this is the default behaviour.

I am loading an html email in to a div like this:

caja.load(document.getElementById('messagebox'), undefined, function(frame) {
    frame.code(contentUrl, 'text/html').run();
});

When it is rendered on the page, the images and hrefs are all stripped out. So you cannot see images or click links.

I am guessing this is the default behaviour to prevent attacks.

My question is how do I allow these to be loaded so that the page is displayed as intended?

Thanks

[Kevin Reid]

On Fri, Apr 14, 2017 at 2:48 AM, felbus <paul....@gmail.com> wrote:

caja.load(document.getElementById('messagebox'), undefined, function(frame) {
    frame.code(contentUrl, 'text/html').run();
});

When it is rendered on the page, the images and hrefs are all stripped out. So you cannot see images or click links.

I am guessing this is the default behaviour to prevent attacks.

My question is how do I allow these to be loaded so that the page is displayed as intended?

You need to specify the URI policy instead of undefined.

The simplest policy is caja.policy.net.ALL which will allow links and images for all sites.

[felbus]

yep, that worked, thanks