From c13d0dc8e9903fbe2d306eecf8da1895f5fff016 Mon Sep 17 00:00:00 2001
From: Julia Radzhabova <Julia.Radzhabova@onlyoffice.com>
Date: Thu, 19 Mar 2020 17:38:09 +0300
Subject: [PATCH] Check origin in messages

---
 apps/api/documents/api.js                              | 10 +++++++++-
 apps/common/Gateway.js                                 |  2 ++
 apps/documenteditor/embed/index.html                   |  1 +
 apps/documenteditor/embed/index.html.deploy            |  1 +
 apps/documenteditor/embed/index_loader.html            |  1 +
 apps/documenteditor/embed/index_loader.html.deploy     |  1 +
 apps/documenteditor/main/index.html                    |  1 +
 apps/documenteditor/main/index.html.deploy             |  1 +
 apps/documenteditor/main/index_loader.html             |  1 +
 apps/documenteditor/main/index_loader.html.deploy      |  1 +
 apps/documenteditor/mobile/index.html                  |  1 +
 apps/documenteditor/mobile/index.html.deploy           |  1 +
 apps/documenteditor/mobile/index_loader.html           |  1 +
 apps/documenteditor/mobile/index_loader.html.deploy    |  1 +
 apps/presentationeditor/embed/index.html               |  1 +
 apps/presentationeditor/embed/index.html.deploy        |  1 +
 apps/presentationeditor/embed/index_loader.html        |  1 +
 apps/presentationeditor/embed/index_loader.html.deploy |  1 +
 apps/presentationeditor/main/index.html                |  1 +
 apps/presentationeditor/main/index.html.deploy         |  1 +
 apps/presentationeditor/main/index.reporter.html       |  1 +
 .../presentationeditor/main/index.reporter.html.deploy |  1 +
 apps/presentationeditor/main/index_loader.html         |  1 +
 apps/presentationeditor/main/index_loader.html.deploy  |  1 +
 apps/presentationeditor/mobile/index.html              |  1 +
 apps/presentationeditor/mobile/index.html.deploy       |  1 +
 apps/presentationeditor/mobile/index_loader.html       |  1 +
 .../presentationeditor/mobile/index_loader.html.deploy |  1 +
 apps/spreadsheeteditor/embed/index.html                |  1 +
 apps/spreadsheeteditor/embed/index.html.deploy         |  1 +
 apps/spreadsheeteditor/embed/index_loader.html         |  1 +
 apps/spreadsheeteditor/embed/index_loader.html.deploy  |  1 +
 apps/spreadsheeteditor/main/index.html                 |  1 +
 apps/spreadsheeteditor/main/index.html.deploy          |  1 +
 apps/spreadsheeteditor/main/index_loader.html          |  1 +
 apps/spreadsheeteditor/main/index_loader.html.deploy   |  1 +
 apps/spreadsheeteditor/mobile/index.html               |  1 +
 apps/spreadsheeteditor/mobile/index.html.deploy        |  1 +
 apps/spreadsheeteditor/mobile/index_loader.html        |  1 +
 apps/spreadsheeteditor/mobile/index_loader.html.deploy |  1 +
 40 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/apps/api/documents/api.js b/apps/api/documents/api.js
index a030d3ba8f..b5540a3c29 100644
--- a/apps/api/documents/api.js
+++ b/apps/api/documents/api.js
@@ -213,6 +213,7 @@
         _config.editorConfig.canRequestCompareFile = _config.events && !!_config.events.onRequestCompareFile;
         _config.editorConfig.canRequestSharingSettings = _config.events && !!_config.events.onRequestSharingSettings;
         _config.frameEditorId = placeholderId;
+        _config.parentOrigin = window.location.origin;
 
         var onMouseUp = function (evt) {
             _processMouse(evt);
@@ -395,6 +396,10 @@
 
         if (target && _checkConfigParams()) {
             iframe = createIframe(_config);
+            if (iframe.src) {
+                var pathArray = iframe.src.split('/');
+                this.frameOrigin = pathArray[0] + '//' + pathArray[2];
+            }
             target.parentNode && target.parentNode.replaceChild(iframe, target);
             var _msgDispatcher = new MessageDispatcher(_onMessage, this);
         }
@@ -683,7 +688,7 @@
 
         var _onMessage = function(msg) {
             // TODO: check message origin
-            if (msg && window.JSON) {
+            if (msg && window.JSON && _scope.frameOrigin==msg.origin ) {
 
                 try {
                     var msg = window.JSON.parse(msg.data);
@@ -806,6 +811,9 @@
         if (config.editorConfig && config.editorConfig.customization && (config.editorConfig.customization.toolbar===false))
             params += "&toolbar=false";
 
+        if (config.parentOrigin)
+            params += "&parentOrigin=" + config.parentOrigin;
+
         return params;
     }
 
diff --git a/apps/common/Gateway.js b/apps/common/Gateway.js
index ec542cb31c..9477b6b380 100644
--- a/apps/common/Gateway.js
+++ b/apps/common/Gateway.js
@@ -135,6 +135,8 @@ if (Common === undefined) {
 
         var _onMessage = function(msg) {
             // TODO: check message origin
+            if (msg.origin !== window.parentOrigin) return;
+
             var data = msg.data;
             if (Object.prototype.toString.apply(data) !== '[object String]' || !window.JSON) {
                 return;
diff --git a/apps/documenteditor/embed/index.html b/apps/documenteditor/embed/index.html
index 619b74394e..d0dec31182 100644
--- a/apps/documenteditor/embed/index.html
+++ b/apps/documenteditor/embed/index.html
@@ -162,6 +162,7 @@
                logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
            window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            var elem = document.querySelector('.loading-logo');
            if (elem && logo) {
diff --git a/apps/documenteditor/embed/index.html.deploy b/apps/documenteditor/embed/index.html.deploy
index 878fc7fa80..58ccf6c9da 100644
--- a/apps/documenteditor/embed/index.html.deploy
+++ b/apps/documenteditor/embed/index.html.deploy
@@ -155,6 +155,7 @@
                            logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
             var elem = document.querySelector('.loading-logo');
             if (elem && logo) {
                 elem.style.backgroundImage= 'none';
diff --git a/apps/documenteditor/embed/index_loader.html b/apps/documenteditor/embed/index_loader.html
index 82e2fa3bfa..eca7003abb 100644
--- a/apps/documenteditor/embed/index_loader.html
+++ b/apps/documenteditor/embed/index_loader.html
@@ -240,6 +240,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
             window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            if ( lang == 'de')      loading = 'Ladevorgang...';
            else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/documenteditor/embed/index_loader.html.deploy b/apps/documenteditor/embed/index_loader.html.deploy
index bac45e2be1..306417012f 100644
--- a/apps/documenteditor/embed/index_loader.html.deploy
+++ b/apps/documenteditor/embed/index_loader.html.deploy
@@ -232,6 +232,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/documenteditor/main/index.html b/apps/documenteditor/main/index.html
index fdd2df9c00..02d53c26c8 100644
--- a/apps/documenteditor/main/index.html
+++ b/apps/documenteditor/main/index.html
@@ -200,6 +200,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <!-- debug begin -->
diff --git a/apps/documenteditor/main/index.html.deploy b/apps/documenteditor/main/index.html.deploy
index 5f0fdbec31..239dae000b 100644
--- a/apps/documenteditor/main/index.html.deploy
+++ b/apps/documenteditor/main/index.html.deploy
@@ -199,6 +199,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {
diff --git a/apps/documenteditor/main/index_loader.html b/apps/documenteditor/main/index_loader.html
index 3872b757ec..34239f1a41 100644
--- a/apps/documenteditor/main/index_loader.html
+++ b/apps/documenteditor/main/index_loader.html
@@ -212,6 +212,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/documenteditor/main/index_loader.html.deploy b/apps/documenteditor/main/index_loader.html.deploy
index 0d2c66fa94..712aa74949 100644
--- a/apps/documenteditor/main/index_loader.html.deploy
+++ b/apps/documenteditor/main/index_loader.html.deploy
@@ -233,6 +233,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/documenteditor/mobile/index.html b/apps/documenteditor/mobile/index.html
index 04369d359f..6604386211 100644
--- a/apps/documenteditor/mobile/index.html
+++ b/apps/documenteditor/mobile/index.html
@@ -161,6 +161,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/documenteditor/mobile/index.html.deploy b/apps/documenteditor/mobile/index.html.deploy
index fbf6bbd2bb..04748a713b 100644
--- a/apps/documenteditor/mobile/index.html.deploy
+++ b/apps/documenteditor/mobile/index.html.deploy
@@ -173,6 +173,7 @@
             }
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/documenteditor/mobile/index_loader.html b/apps/documenteditor/mobile/index_loader.html
index 3b4bd432e3..0300f4fff7 100644
--- a/apps/documenteditor/mobile/index_loader.html
+++ b/apps/documenteditor/mobile/index_loader.html
@@ -192,6 +192,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/documenteditor/mobile/index_loader.html.deploy b/apps/documenteditor/mobile/index_loader.html.deploy
index 0fbe223db5..c73fa3754c 100644
--- a/apps/documenteditor/mobile/index_loader.html.deploy
+++ b/apps/documenteditor/mobile/index_loader.html.deploy
@@ -225,6 +225,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/presentationeditor/embed/index.html b/apps/presentationeditor/embed/index.html
index 5965d60f60..244110e070 100644
--- a/apps/presentationeditor/embed/index.html
+++ b/apps/presentationeditor/embed/index.html
@@ -213,6 +213,7 @@
               logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {
diff --git a/apps/presentationeditor/embed/index.html.deploy b/apps/presentationeditor/embed/index.html.deploy
index ce530f4190..baac7d2fa7 100644
--- a/apps/presentationeditor/embed/index.html.deploy
+++ b/apps/presentationeditor/embed/index.html.deploy
@@ -207,6 +207,7 @@
                logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
            window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            var elem = document.querySelector('.loading-logo');
            if (elem && logo) {
diff --git a/apps/presentationeditor/embed/index_loader.html b/apps/presentationeditor/embed/index_loader.html
index 53fb0a0bde..7b46cc5fa1 100644
--- a/apps/presentationeditor/embed/index_loader.html
+++ b/apps/presentationeditor/embed/index_loader.html
@@ -239,6 +239,7 @@
               logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           if ( lang == 'de')      loading = 'Ladevorgang...';
           else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/presentationeditor/embed/index_loader.html.deploy b/apps/presentationeditor/embed/index_loader.html.deploy
index d0dd00e6cc..2c48fd3641 100644
--- a/apps/presentationeditor/embed/index_loader.html.deploy
+++ b/apps/presentationeditor/embed/index_loader.html.deploy
@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/presentationeditor/main/index.html b/apps/presentationeditor/main/index.html
index 852f76a8b8..44708b4d34 100644
--- a/apps/presentationeditor/main/index.html
+++ b/apps/presentationeditor/main/index.html
@@ -228,6 +228,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <!-- debug begin -->
diff --git a/apps/presentationeditor/main/index.html.deploy b/apps/presentationeditor/main/index.html.deploy
index 1f4bfd570e..4bc6215300 100644
--- a/apps/presentationeditor/main/index.html.deploy
+++ b/apps/presentationeditor/main/index.html.deploy
@@ -236,6 +236,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {
diff --git a/apps/presentationeditor/main/index.reporter.html b/apps/presentationeditor/main/index.reporter.html
index 01fe412d81..a1f9a42b11 100644
--- a/apps/presentationeditor/main/index.reporter.html
+++ b/apps/presentationeditor/main/index.reporter.html
@@ -180,6 +180,7 @@
             presenter = 'Presenter View';
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'bg') { presenter = 'Изглед на презентатора';}
         else if ( lang == 'cs') { presenter = 'Zobrazení přednášejícího';}
diff --git a/apps/presentationeditor/main/index.reporter.html.deploy b/apps/presentationeditor/main/index.reporter.html.deploy
index e25ca5aefb..16f4445850 100644
--- a/apps/presentationeditor/main/index.reporter.html.deploy
+++ b/apps/presentationeditor/main/index.reporter.html.deploy
@@ -176,6 +176,7 @@
             presenter = 'Presenter View';
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'bg') { presenter = 'Изглед на презентатора';}
         else if ( lang == 'cs') { presenter = 'Zobrazení přednášejícího';}
diff --git a/apps/presentationeditor/main/index_loader.html b/apps/presentationeditor/main/index_loader.html
index 4d37d5841e..3a7e023ebf 100644
--- a/apps/presentationeditor/main/index_loader.html
+++ b/apps/presentationeditor/main/index_loader.html
@@ -203,6 +203,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/presentationeditor/main/index_loader.html.deploy b/apps/presentationeditor/main/index_loader.html.deploy
index 4f454d42f8..5c46acf019 100644
--- a/apps/presentationeditor/main/index_loader.html.deploy
+++ b/apps/presentationeditor/main/index_loader.html.deploy
@@ -233,6 +233,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/presentationeditor/mobile/index.html b/apps/presentationeditor/mobile/index.html
index e747436329..f10e8f8c0d 100644
--- a/apps/presentationeditor/mobile/index.html
+++ b/apps/presentationeditor/mobile/index.html
@@ -212,6 +212,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/presentationeditor/mobile/index.html.deploy b/apps/presentationeditor/mobile/index.html.deploy
index c9cba6fcf6..4b14358763 100644
--- a/apps/presentationeditor/mobile/index.html.deploy
+++ b/apps/presentationeditor/mobile/index.html.deploy
@@ -224,6 +224,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/presentationeditor/mobile/index_loader.html b/apps/presentationeditor/mobile/index_loader.html
index fb37270cd9..9bd13b7b98 100644
--- a/apps/presentationeditor/mobile/index_loader.html
+++ b/apps/presentationeditor/mobile/index_loader.html
@@ -192,6 +192,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/presentationeditor/mobile/index_loader.html.deploy b/apps/presentationeditor/mobile/index_loader.html.deploy
index b498c88635..5e0dea145a 100644
--- a/apps/presentationeditor/mobile/index_loader.html.deploy
+++ b/apps/presentationeditor/mobile/index_loader.html.deploy
@@ -225,6 +225,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/spreadsheeteditor/embed/index.html b/apps/spreadsheeteditor/embed/index.html
index a1044311f5..64956c1a04 100644
--- a/apps/spreadsheeteditor/embed/index.html
+++ b/apps/spreadsheeteditor/embed/index.html
@@ -188,6 +188,7 @@
               logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {
diff --git a/apps/spreadsheeteditor/embed/index.html.deploy b/apps/spreadsheeteditor/embed/index.html.deploy
index 5b9ef30845..5c3163b350 100644
--- a/apps/spreadsheeteditor/embed/index.html.deploy
+++ b/apps/spreadsheeteditor/embed/index.html.deploy
@@ -180,6 +180,7 @@
                       logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {
diff --git a/apps/spreadsheeteditor/embed/index_loader.html b/apps/spreadsheeteditor/embed/index_loader.html
index b29cba7c50..05a9c74f0b 100644
--- a/apps/spreadsheeteditor/embed/index_loader.html
+++ b/apps/spreadsheeteditor/embed/index_loader.html
@@ -240,6 +240,7 @@
               logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           if ( lang == 'de')      loading = 'Ladevorgang...';
           else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/spreadsheeteditor/embed/index_loader.html.deploy b/apps/spreadsheeteditor/embed/index_loader.html.deploy
index 0ff36eae59..c90da3dfd3 100644
--- a/apps/spreadsheeteditor/embed/index_loader.html.deploy
+++ b/apps/spreadsheeteditor/embed/index_loader.html.deploy
@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/spreadsheeteditor/main/index.html b/apps/spreadsheeteditor/main/index.html
index a2d6ce8565..d5f6d1b01a 100644
--- a/apps/spreadsheeteditor/main/index.html
+++ b/apps/spreadsheeteditor/main/index.html
@@ -228,6 +228,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <link rel="stylesheet" type="text/css" href="../../../../sdkjs/cell/css/main.css"/>
diff --git a/apps/spreadsheeteditor/main/index.html.deploy b/apps/spreadsheeteditor/main/index.html.deploy
index a4b2302d5f..44a9292537 100644
--- a/apps/spreadsheeteditor/main/index.html.deploy
+++ b/apps/spreadsheeteditor/main/index.html.deploy
@@ -236,6 +236,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {
diff --git a/apps/spreadsheeteditor/main/index_loader.html b/apps/spreadsheeteditor/main/index_loader.html
index ed24698387..96dc38c174 100644
--- a/apps/spreadsheeteditor/main/index_loader.html
+++ b/apps/spreadsheeteditor/main/index_loader.html
@@ -202,6 +202,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/spreadsheeteditor/main/index_loader.html.deploy b/apps/spreadsheeteditor/main/index_loader.html.deploy
index 678920fd36..439f6566b7 100644
--- a/apps/spreadsheeteditor/main/index_loader.html.deploy
+++ b/apps/spreadsheeteditor/main/index_loader.html.deploy
@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
diff --git a/apps/spreadsheeteditor/mobile/index.html b/apps/spreadsheeteditor/mobile/index.html
index 24e54ebc0e..87d8d17918 100644
--- a/apps/spreadsheeteditor/mobile/index.html
+++ b/apps/spreadsheeteditor/mobile/index.html
@@ -187,6 +187,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/spreadsheeteditor/mobile/index.html.deploy b/apps/spreadsheeteditor/mobile/index.html.deploy
index 51bf2f76cc..d5fec534e4 100644
--- a/apps/spreadsheeteditor/mobile/index.html.deploy
+++ b/apps/spreadsheeteditor/mobile/index.html.deploy
@@ -195,6 +195,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {
diff --git a/apps/spreadsheeteditor/mobile/index_loader.html b/apps/spreadsheeteditor/mobile/index_loader.html
index acdcf4a427..923630501b 100644
--- a/apps/spreadsheeteditor/mobile/index_loader.html
+++ b/apps/spreadsheeteditor/mobile/index_loader.html
@@ -193,6 +193,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';
diff --git a/apps/spreadsheeteditor/mobile/index_loader.html.deploy b/apps/spreadsheeteditor/mobile/index_loader.html.deploy
index bd73d6f97f..1627205dca 100644
--- a/apps/spreadsheeteditor/mobile/index_loader.html.deploy
+++ b/apps/spreadsheeteditor/mobile/index_loader.html.deploy
@@ -224,6 +224,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';