[PR] Fixed: Order view page CSS leak from embedded email communication content [ofbiz-framework]

["toaditi (via GitHub)" <gi...@apache.org>]

toaditi opened a new pull request, #1213:
URL: https://github.com/apache/ofbiz-framework/pull/1213

   ## Summary
   
   When a `CommunicationEvent` exists on an order, the `OrderConversations` screen dumps the stored email HTML (a full `<!DOCTYPE html>` document, with its own `<style>` block containing a global CSS reset) directly inline into the order view page. Browsers parse that `<style>` at document scope — not div scope — so the email's reset cascades into the parent page and breaks the order layout: tables lose padding, the body background changes, `.screenlet` styling is overridden, etc.
   
   ## Fix
   
   Render the email body inside an `<iframe>` so its CSS lives in its own document context and cannot leak. The stored content is HTML-entity-encoded, so it's decoded client-side via a `<textarea>` before being assigned to `srcdoc`.
   
   One file changed: `applications/party/template/party/DisplayCommunicationContent.ftl`.
   
   ## Test plan
   
   - [ ] Open an order that has at least one communication event (e.g. send an order confirmation email, then revisit the order view).
   - [ ] Expand the "All Communication Events" section.
   - [ ] Verify the email body renders inside a bordered iframe with the email's own styling (heading, cards, items table).
   - [ ] Verify the parent order view page styling is unaffected — tables, padding, screenlets all render normally.
   - [ ] Verify the iframe auto-resizes to fit the email content (`onload` handler).
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: Order view page CSS leak from embedded email communication content (OFBIZ-13390) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak merged PR #1213:
URL: https://github.com/apache/ofbiz-framework/pull/1213


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org