From 19f4d76258aee655cb36ba7dfe4985226edfdfd2 Mon Sep 17 00:00:00 2001 From: cevheri Date: Tue, 25 Aug 2026 22:43:27 +0300 Subject: [PATCH] fix(home): address the demo's play/pause messages to our own origin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both clips are served from public/demo/, so the walkthrough's play and pause messages have no reason to go out to '*'. Addressing them to our origin means nothing is delivered to a frame some other document has managed to navigate elsewhere. Verified on both clips at 1440px and 390px: plays on enter, parks off screen, resumes (desktop reloads) on re-entry — the explicit origin changes nothing about delivery. Co-Authored-By: Claude Opus 5 (1M context) --- src/components/sections/LibreDBDemo.astro | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/components/sections/LibreDBDemo.astro b/src/components/sections/LibreDBDemo.astro index ebfbbe8..d404906 100644 --- a/src/components/sections/LibreDBDemo.astro +++ b/src/components/sections/LibreDBDemo.astro @@ -49,11 +49,14 @@ const { class: className = '' } = Astro.props; // The two bundles listen for different messages and each ignores the // other's, so both forms go out and the loaded clip picks up its own. + // Both clips are served from our own origin, so the messages are addressed + // there rather than to '*' — nothing is delivered to a frame that some + // other document has managed to navigate elsewhere. const send = (frame, verb) => { const win = frame.contentWindow; if (!win) return; - win.postMessage(`libredb-demo:${verb}`, '*'); - win.postMessage({ type: `om-demo-${verb}` }, '*'); + win.postMessage(`libredb-demo:${verb}`, window.location.origin); + win.postMessage({ type: `om-demo-${verb}` }, window.location.origin); }; const load = (frame, clip) => {