Iframe apps support a sandbox attribute for security restrictions, but it could only be configured by manually editing JSON files. This adds UI controls in the admin panel.

Changes

• Added sandbox permissions editor in AppFormEditor.jsx iframe configuration section
  • 6 checkboxes for common permissions: allow-scripts, allow-same-origin, allow-forms, allow-popups, allow-modals, allow-top-navigation
  • Descriptive labels explaining each permission's purpose
  • Defaults to ['allow-scripts', 'allow-same-origin', 'allow-forms'] when undefined

Example

Administrators can now configure this through checkboxes:

{
  "type": "iframe",
  "iframeConfig": {
    "url": "https://excalidraw.com/",
    "allowFullscreen": true,
    "sandbox": ["allow-scripts", "allow-same-origin", "allow-forms", "allow-popups"]
  }
}

Schema validation already exists in appConfigSchema.js (lines 204-208). The UI component follows existing patterns for form field management.

• Fixes Allow app type config in the admin #539

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.