ISS-111 fix verified: frame-src CSP entries in jwuiisg.sup

The user added CSP_ENTRY frame-src 'self' and the test host to
jwuiisg.sup and restarted CI Server (JWUIISG reads the file only at
start). The header then allowed the host and the external page showed
in a temporary display in the web client (display removed again).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/graphics/tasks/create-display.md

@@ -83,7 +83,7 @@ Module, the Operator Interface and the HTML display, if these rules are kept (sa
 | Actions sheet (§4.12, R1.04) | *Update item/parameter* on an item, object signal or parameter can carry **Reason** (≤ 256 chars) and **Approver** (≤ 128 chars); they land in `AUDIT_TRAIL` fields `APPROVAL_REASON` / `APPROVER` (skill `audit-trail`). Two documented recipes for alarm acknowledgement with reason/approver: via an item parameter (attribute *Acknowledged* = 1, item alarms only) or via the overview's *External Acknowledgement* properties (item and external alarms). Not tested. |
 | Dataset tables (§2.25, R1.05) | Column **Icon**, *Icon filter* (`<v>`, `!<v>`, `&<v>` bit test), *Icon tooltip*; *Operator can use column sorters*; *Operator can select row(s)* / *multiple rows*; *[Enterprise Dataset Locations]*; enterprise location supported on the HTML display. |
 | Report (§2.26, R1.05) | New *[Enterprise]* category (primary / secondary data location). |
-| Web Browser (§2.33, R1.05) — **web client: external pages are blocked** by the R1.05 default Content-Security-Policy (verified 2026-10-09, ISS-111); only pages from the CI Server itself load. Component type `extendedIExplorer` (class `WebBrowserChromium`), property `url` | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
+| Web Browser (§2.33, R1.05) — **web client: external pages are blocked** by the R1.05 default Content-Security-Policy (verified 2026-10-09, ISS-111); only pages from the CI Server itself load, unless the host is added as `frame-src` in `jwuiisg.sup` (skill `portal-setup`, `check-web-access.md`; verified). Component type `extendedIExplorer` (class `WebBrowserChromium`), property `url` | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
 | Display generator (§2.36) | The note "not supported on HTML displays" was removed in the R1.05 manual; R30 §4.8 does not list it. Treat web support as unconfirmed. |
 | `jwuiutl -m` / `-M` (§1.5) | Output now described as space-separated (R1.03 manual: CSV). On R1.03 `-m` printed comma-separated lines (verified); R1.05 output not checked (ISS-094). |
 

.claude/skills/portal-setup/tasks/check-web-access.md

@@ -86,7 +86,20 @@ font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` ru
 `default-src` applies: the browser refused to frame `https://example.com/` (a
 `securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
 loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
-stays empty in the browser. Possible fix, **not tested**: add a `CSP_ENTRY` with
+stays empty in the browser.
-`frame-src 'self' https://<allowed host>` on the *Security* tab of `jwuiisg.sup` (administrator;
+
-check whether the web server needs a restart). The desktop Operator Interface (JCEF browser) is
+**Fix (verified 2026-10-09 on the R1.05 test server):** allow the external host for frames in
-not affected by these headers (not tested).
+`jwuiisg.sup`, *Security* tab, one `CSP_ENTRY` line per value after the installed ones:
+
+```
+CSP_ENTRY = frame-src, "'self'"
+CSP_ENTRY = frame-src, "https://<allowed host>"
+```
+
+Keep `'self'`, otherwise pages from the CI Server itself are blocked in frames too. The web
+server `JWUIISG` (started by `user_start.cmd`) reads the file only at start: the change takes
+effect after a CI Server restart (needs administrator rights and disconnects all operator
+clients). Then the header contains `frame-src 'self' https://<allowed host>`, and the test page
+showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
+the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
+these headers (not tested).

knowledge/issues.md

@@ -126,7 +126,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-108 | 2026-10-08 | PORTAL (installation media) | IM 36K10R10 4th ed. §3.1 (R1.04): CI Portal setup runs from the mounted CI Server ISO file instead of the DVD; not in the revision table. §3.3 only gained a reference to IM 36K10L30 ch. 3. | closed | Documented. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md` (done) |
 | ISS-109 | 2026-10-08 | PORTAL / BUS (`dur.sup`) | R1.05 `dur.sup` has a new switch `gateway_core` (General tab, installed No) and a new adaptive queue set `ADTSTO, 1.00`. IM 36K10R10 does not mention them; see ISS-116 for the gateway configuration. | closed | Installed software is the reference. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/SKILL.md` (done) |
 | ISS-110 | 2026-10-08 | PORTAL (`jwuiisg.sup` keywords) | R1.05 `jwuiisg.sup` has keywords IM 36K10R10 §4.3 does not describe: `SERVER_FILE_CACHE`, `HTTP_TO_HTTPS_REDIRECT`, `RECONNECT_TIMEOUT_OVERRIDE`, and a new tab *Access Control* (`RESTRICT_IP_ACCESS`, `HOSTNAME_WHITELISTING`). | closed | Installed software is the reference; documented from the file's own help. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done) |
-| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | open | 2026-10-09: answered with a temporary display - the default R1.05 CSP (no frame-src, default-src self) blocks external pages in a web browser component on the web client; same-origin pages load. Possible fix (not tested): a CSP_ENTRY with frame-src for the allowed host. Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
+| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | closed | 2026-10-09: fix verified - CSP_ENTRY = frame-src, "'self'" plus one line per allowed host in jwuiisg.sup, then a CI Server restart (JWUIISG reads the file only at start); the external page then loaded in the display. Close when the user confirms. 2026-10-09: answered with a temporary display - the default R1.05 CSP (no frame-src, default-src self) blocks external pages in a web browser component on the web client; same-origin pages load. Possible fix (not tested): a CSP_ENTRY with frame-src for the allowed host. Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
 | ISS-112 | 2026-10-08 | SETUP FILE EDITOR (`jwuiisg.sup` metadata) | R1.05 `jwuiisg.sup` metadata quirks: two keyword blocks end with `!ENDKEYWORD!`; `SERVER_FILE_CACHE=0` without spaces in `!DEFAULT`; `RECONNECT_TIMEOUT_OVERRIDE` has no active or default line; `RESTRICT_IP_ACCESS` has no keyword for the allowed addresses. | open | Awaiting user verification in the Setup File Editor GUI (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `IM36K10R10-01EN.md` (done) |
 | ISS-113 | 2026-10-08 | SETUP FILE EDITOR (R1.05 GUI) | R1.05 `fsuedit.cmd` only adds `tls\exe\lib\*` to the class path; metadata keywords and `!KIND`s unchanged. The R1.03 GUI findings (ISS-015/016) are not re-checked on R1.05. | open | Awaiting user verification (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `.claude/skills/portal-setup/tasks/change-setup-file.md` (done) |
 | ISS-116 | 2026-10-08 | BUS / SYSTEM DESIGN (gateway core) | IM 36K10J10 5th ed. has a new §3.2.6 *Gateway* configuration, not in the revision table: a gateway-licensed CI Core has no operator interface (nor do CI Portals / CI View connected to it); switched on with `GATEWAY_CORE` in `dur.sup`; a licence/switch mismatch is logged. IM 36K10L30 does not describe the keyword. | open | Not tested (no gateway licence; needs admin and a restart). | `knowledge/manuals/IM36K10J10-01EN.md`, `IM36K10L30-01EN.md`, `.claude/skills/system-management/tasks/bus-utilities.md` (done) |

knowledge/r105-verification.md

@@ -189,4 +189,6 @@ display folders were compared before and after (identical). No existing display
 `Layouts.xml` was touched.
 - Trend with 2 pens: draws on the web (ISS-096 closed; `graphics/tasks/trend.md`).
 - Web browser component: external pages are blocked by the default CSP, same-origin pages load
-  (ISS-111; `portal-setup/tasks/check-web-access.md`).
+  (ISS-111; `portal-setup/tasks/check-web-access.md`). Fix verified the same day: the user added
+  two `frame-src` `CSP_ENTRY` lines to `jwuiisg.sup` and restarted CI Server; the external test
+  page then showed in the display (temporary display deployed again and removed).