From 423a0664cd309de050ca05b3a6e3d1feca36a919 Mon Sep 17 00:00:00 2001
From: Bruno Windels <brunow@element.io>
Date: Wed, 3 Mar 2021 17:50:23 +0100
Subject: [PATCH] check origin in download sandbox

---
 assets/download-sandbox.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/assets/download-sandbox.html b/assets/download-sandbox.html
index d8b26fad..f484a4b7 100644
--- a/assets/download-sandbox.html
+++ b/assets/download-sandbox.html
@@ -4,7 +4,7 @@
         <meta charset="utf-8">
     </head>
     <body>
-        <a id="link" href="#">Download!</a>
+        <a id="link" href="#">Download</a>
         <script type="text/javascript">
             var link = document.getElementById("link");
             function download(blob, filename) {
@@ -15,7 +15,7 @@
                 URL.revokeObjectURL(url);
             }
             window.addEventListener("message", function(event) {
-                if (event.data.type === "download") {
+                if (event.origin === window.location.origin && event.data.type === "download") {
                     download(event.data.blob, event.data.filename);
                 }
             });
