.claude/skills/graphics/tasks/create-display.md

@@ -83,7 +83,7 @@ Module, the Operator Interface and the HTML display, if these rules are kept (sa
 | Actions sheet (§4.12, R1.04) | *Update item/parameter* on an item, object signal or parameter can carry **Reason** (≤ 256 chars) and **Approver** (≤ 128 chars); they land in `AUDIT_TRAIL` fields `APPROVAL_REASON` / `APPROVER` (skill `audit-trail`). Two documented recipes for alarm acknowledgement with reason/approver: via an item parameter (attribute *Acknowledged* = 1, item alarms only) or via the overview's *External Acknowledgement* properties (item and external alarms). Not tested. |
 | Dataset tables (§2.25, R1.05) | Column **Icon**, *Icon filter* (`<v>`, `!<v>`, `&<v>` bit test), *Icon tooltip*; *Operator can use column sorters*; *Operator can select row(s)* / *multiple rows*; *[Enterprise Dataset Locations]*; enterprise location supported on the HTML display. |
 | Report (§2.26, R1.05) | New *[Enterprise]* category (primary / secondary data location). |
-| Web Browser (§2.33, R1.05) — **web client: external pages are blocked** by the R1.05 default Content-Security-Policy (verified 2026-10-09, ISS-111); only pages from the CI Server itself load. Component type `extendedIExplorer` (class `WebBrowserChromium`), property `url` | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
+| Web Browser (§2.33, R1.05) — **web client: external pages are blocked** by the R1.05 default Content-Security-Policy (verified 2026-10-09, ISS-111); only pages from the CI Server itself load, unless the host is added as `frame-src` in `jwuiisg.sup` (skill `portal-setup`, `check-web-access.md`; verified). Component type `extendedIExplorer` (class `WebBrowserChromium`), property `url` | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
 | Display generator (§2.36) | The note "not supported on HTML displays" was removed in the R1.05 manual; R30 §4.8 does not list it. Treat web support as unconfirmed. |
 | `jwuiutl -m` / `-M` (§1.5) | Output now described as space-separated (R1.03 manual: CSV). On R1.03 `-m` printed comma-separated lines (verified); R1.05 output not checked (ISS-094). |
 

.claude/skills/portal-setup/tasks/check-web-access.md

@@ -86,7 +86,20 @@ font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` ru
 `default-src` applies: the browser refused to frame `https://example.com/` (a
 `securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
 loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
-stays empty in the browser. Possible fix, **not tested**: add a `CSP_ENTRY` with
+stays empty in the browser.
-`frame-src 'self' https://<allowed host>` on the *Security* tab of `jwuiisg.sup` (administrator;
+
-check whether the web server needs a restart). The desktop Operator Interface (JCEF browser) is
+**Fix (verified 2026-10-09 on the R1.05 test server):** allow the external host for frames in
-not affected by these headers (not tested).
+`jwuiisg.sup`, *Security* tab, one `CSP_ENTRY` line per value after the installed ones:
+
+```
+CSP_ENTRY = frame-src, "'self'"
+CSP_ENTRY = frame-src, "https://<allowed host>"
+```
+
+Keep `'self'`, otherwise pages from the CI Server itself are blocked in frames too. The web
+server `JWUIISG` (started by `user_start.cmd`) reads the file only at start: the change takes
+effect after a CI Server restart (needs administrator rights and disconnects all operator
+clients). Then the header contains `frame-src 'self' https://<allowed host>`, and the test page
+showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
+the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
+these headers (not tested).

knowledge/issues.md

@@ -126,7 +126,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-108 | 2026-10-08 | PORTAL (installation media) | IM 36K10R10 4th ed. §3.1 (R1.04): CI Portal setup runs from the mounted CI Server ISO file instead of the DVD; not in the revision table. §3.3 only gained a reference to IM 36K10L30 ch. 3. | closed | Documented. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md` (done) |
 | ISS-109 | 2026-10-08 | PORTAL / BUS (`dur.sup`) | R1.05 `dur.sup` has a new switch `gateway_core` (General tab, installed No) and a new adaptive queue set `ADTSTO, 1.00`. IM 36K10R10 does not mention them; see ISS-116 for the gateway configuration. | closed | Installed software is the reference. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/SKILL.md` (done) |
 | ISS-110 | 2026-10-08 | PORTAL (`jwuiisg.sup` keywords) | R1.05 `jwuiisg.sup` has keywords IM 36K10R10 §4.3 does not describe: `SERVER_FILE_CACHE`, `HTTP_TO_HTTPS_REDIRECT`, `RECONNECT_TIMEOUT_OVERRIDE`, and a new tab *Access Control* (`RESTRICT_IP_ACCESS`, `HOSTNAME_WHITELISTING`). | closed | Installed software is the reference; documented from the file's own help. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done) |
-| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | open | 2026-10-09: answered with a temporary display - the default R1.05 CSP (no frame-src, default-src self) blocks external pages in a web browser component on the web client; same-origin pages load. Possible fix (not tested): a CSP_ENTRY with frame-src for the allowed host. Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
+| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | closed | 2026-10-09: fix verified - CSP_ENTRY = frame-src, "'self'" plus one line per allowed host in jwuiisg.sup, then a CI Server restart (JWUIISG reads the file only at start); the external page then loaded in the display. Close when the user confirms. 2026-10-09: answered with a temporary display - the default R1.05 CSP (no frame-src, default-src self) blocks external pages in a web browser component on the web client; same-origin pages load. Possible fix (not tested): a CSP_ENTRY with frame-src for the allowed host. Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
 | ISS-112 | 2026-10-08 | SETUP FILE EDITOR (`jwuiisg.sup` metadata) | R1.05 `jwuiisg.sup` metadata quirks: two keyword blocks end with `!ENDKEYWORD!`; `SERVER_FILE_CACHE=0` without spaces in `!DEFAULT`; `RECONNECT_TIMEOUT_OVERRIDE` has no active or default line; `RESTRICT_IP_ACCESS` has no keyword for the allowed addresses. | open | Awaiting user verification in the Setup File Editor GUI (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `IM36K10R10-01EN.md` (done) |
 | ISS-113 | 2026-10-08 | SETUP FILE EDITOR (R1.05 GUI) | R1.05 `fsuedit.cmd` only adds `tls\exe\lib\*` to the class path; metadata keywords and `!KIND`s unchanged. The R1.03 GUI findings (ISS-015/016) are not re-checked on R1.05. | open | Awaiting user verification (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `.claude/skills/portal-setup/tasks/change-setup-file.md` (done) |
 | ISS-116 | 2026-10-08 | BUS / SYSTEM DESIGN (gateway core) | IM 36K10J10 5th ed. has a new §3.2.6 *Gateway* configuration, not in the revision table: a gateway-licensed CI Core has no operator interface (nor do CI Portals / CI View connected to it); switched on with `GATEWAY_CORE` in `dur.sup`; a licence/switch mismatch is logged. IM 36K10L30 does not describe the keyword. | open | Not tested (no gateway licence; needs admin and a restart). | `knowledge/manuals/IM36K10J10-01EN.md`, `IM36K10L30-01EN.md`, `.claude/skills/system-management/tasks/bus-utilities.md` (done) |

knowledge/r105-verification.md

@@ -189,4 +189,6 @@ display folders were compared before and after (identical). No existing display
 `Layouts.xml` was touched.
 - Trend with 2 pens: draws on the web (ISS-096 closed; `graphics/tasks/trend.md`).
 - Web browser component: external pages are blocked by the default CSP, same-origin pages load
-  (ISS-111; `portal-setup/tasks/check-web-access.md`).
+  (ISS-111; `portal-setup/tasks/check-web-access.md`). Fix verified the same day: the user added
+  two `frame-src` `CSP_ENTRY` lines to `jwuiisg.sup` and restarted CI Server; the external test
+  page then showed in the display (temporary display deployed again and removed).