cliu/ci-server-engineer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

R1.05 V5 and V6: graphics files and history checks on the test server #32

Merged
cliu merged 4 commits from docs/r105-v5-v6 into main 2026-10-09 15:16:18 +11:00
Conversation 0 Commits 4 Files changed 13 +9
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit fd2666ddb1 - Show all commits

9
.claude/skills/portal-setup/tasks/check-web-access.md
View file

@ -103,3 +103,12 @@ clients). Then the header contains `frame-src 'self' https://<allowed host>`, an
showed inside the display with no CSP violation. List only the hosts you need; to undo, remove showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
these headers (not tested). these headers (not tested).
**Who loads the framed page.** In the web client the page in a web browser component is fetched
by the viewer's own browser, not by the CI Server. So besides the `frame-src` entry, the target
site must accept requests from every machine that opens the web client: a site that only admits
the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or
shows an error, although the same display works in the Operator Interface on the CI Server
(there the browser runs on the server). Check from a viewer PC with `curl -I <url>`. The target
must also not forbid framing (`X-Frame-Options` or its own CSP `frame-ancestors`). Seen on the
R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.