External Content - Revision history

Ollvihe at 23:51, 3 April 2026

2026-04-03T23:51:12Z

← Older revision		Revision as of 23:51, 3 April 2026
Line 18:		Line 18:
	By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content-Security-Policy (CSP) HTTP header's ''child-src'' and ''frame-src'' directives.		By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content-Security-Policy (CSP) HTTP header's ''child-src'' and ''frame-src'' directives.

	Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:		Example CSP to allow embedding the https://www.google.com website to QPR ProcessAnalyzer:
	<pre>		<pre>
	default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:; upgrade-insecure-requests;		default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://www.google.com/;frame-src 'self' https://www.google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:; upgrade-insecure-requests;
	</pre>		</pre>

Ollvihe: /* Content-Security-Policy Restrictions */

2026-04-03T23:30:47Z

Content-Security-Policy Restrictions

← Older revision		Revision as of 23:30, 3 April 2026
Line 20:		Line 20:
	Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:		Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:
	<pre>		<pre>
	default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;		default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:; upgrade-insecure-requests;
	</pre>		</pre>

TeeHiet: TK-63125

2026-03-31T07:35:15Z

TK-63125

← Older revision		Revision as of 07:35, 31 March 2026
Line 1:		Line 1:
	External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.		External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.

			The properties of the External Content component can be opened when the dashboard is in the Add component mode.

	== External Content URL ==		== External Content URL ==
Line 5:		Line 7:

	== Passing Variables in Url==		== Passing Variables in Url==
	You can pass context variable values in the iframe url using the variable tags. Example:		You can pass context variable values in the iframe url using the variable tags. The variables can be configured on the Variables tab of the External Component properties. Example:

			'''<nowiki>http(s)://SERVERNAME/ExternalPresentationObjects/<#variableName></nowiki>'''

	~~'''<nowiki>http~~(s)~~://SERVERNAME/ExternalPresentationObjects/ExternalPresentationObject1#variable1~~=~~<#variable1>&variable2=<#variable2></nowiki>''~~'		* When an effective dashboard variable value is changed, the external page url changes to reflect the up-to-date variable values. If the changed variable tag appears after the anchor (#) in the url, the web page is not reloaded.
			* If there is an equals sign (=) immediately before the tag, the value is url component encoded, because it's assumed to be a url parameter value. Otherwise, no encoding is applied and the variable value is placed to the url as such.
			* Variables can contain any type of data and the values are converted to strings when placed in the url. If the url has a tag and the corresponding variable does not exist, the tag is replaced with an empty value.

	== Content-Security-Policy Restrictions==		== Content-Security-Policy Restrictions==

Ollvihe: /* Content-Security-Policy Restrictions */

2026-03-24T15:00:33Z

Content-Security-Policy Restrictions

← Older revision		Revision as of 15:00, 24 March 2026
Line 10:		Line 10:

	== Content-Security-Policy Restrictions==		== Content-Security-Policy Restrictions==
	By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content ~~security policy~~ (CSP) HTTP header ''child-src'' and ''frame-src'' directives.		By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content-Security-Policy (CSP) HTTP header's ''child-src'' and ''frame-src'' directives.

	Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:		Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:

Ollvihe: /* Content-Security-Policy restrictions */

2026-03-24T14:59:55Z

Content-Security-Policy restrictions

← Older revision		Revision as of 14:59, 24 March 2026
Line 9:		Line 9:
	'''<nowiki>http(s)://SERVERNAME/ExternalPresentationObjects/ExternalPresentationObject1#variable1=<#variable1>&variable2=<#variable2></nowiki>'''		'''<nowiki>http(s)://SERVERNAME/ExternalPresentationObjects/ExternalPresentationObject1#variable1=<#variable1>&variable2=<#variable2></nowiki>'''

	== Content-Security-Policy ~~restrictions~~==		== Content-Security-Policy Restrictions==
	By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives.		By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives.

Ollvihe: /* Content-Security-Policy restrictions */

2026-03-24T14:58:05Z

Content-Security-Policy restrictions

← Older revision		Revision as of 14:58, 24 March 2026
Line 10:		Line 10:

	== Content-Security-Policy restrictions==		== Content-Security-Policy restrictions==
	By default, only websites from the same origin than ~~the~~ QPR ProcessAnalyzer ~~server~~ can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives.		By default, only websites from the same origin than QPR ProcessAnalyzer can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives.

	Example to allow ~~to embed~~ the google.com website to QPR ProcessAnalyzer:		Example CSP to allow embedding the https://google.com website to QPR ProcessAnalyzer:
	<pre>		<pre>
	default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;		default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;

Ollvihe at 14:57, 24 March 2026

2026-03-24T14:57:02Z

← Older revision		Revision as of 14:57, 24 March 2026
Line 1:		Line 1:
	External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.		External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.

	By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].

	== External Content URL ==		== External Content URL ==
Line 10:		Line 8:

	'''<nowiki>http(s)://SERVERNAME/ExternalPresentationObjects/ExternalPresentationObject1#variable1=<#variable1>&variable2=<#variable2></nowiki>'''		'''<nowiki>http(s)://SERVERNAME/ExternalPresentationObjects/ExternalPresentationObject1#variable1=<#variable1>&variable2=<#variable2></nowiki>'''

			== Content-Security-Policy restrictions==
			By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives.

			Example to allow to embed the google.com website to QPR ProcessAnalyzer:
			<pre>
			default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self' https://google.com/;frame-src 'self' https://google.com/;object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;
			</pre>

			More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].

	== Web Browser Security Considerations ==		== Web Browser Security Considerations ==
	Some websites prevent themselves to be embedded into other websites using iframe. In those cases, the component will be left blank (in Chrome and Firefox) or there may be an error message "This content cannot be displayed in a frame". The way to workaround the issue is to have '''X-Frame-Options''' HTTP response header changed in the embedded website (more information: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).		Some websites prevent themselves to be embedded into other websites using iframe. In those cases, the component will be left blank (in Chrome and Firefox) or there may be an error message "This content cannot be displayed in a frame". The way to workaround the issue is to have '''X-Frame-Options''' HTTP response header changed in the embedded website (more information: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).

Ollvihe at 14:54, 24 March 2026

2026-03-24T14:54:27Z

← Older revision		Revision as of 14:54, 24 March 2026
Line 1:		Line 1:
	External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.		External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.

	By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' ~~directive~~. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].		By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' and ''frame-src'' directives. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].

	== External Content URL ==		== External Content URL ==

Ollvihe at 14:52, 24 March 2026

2026-03-24T14:52:02Z

← Older revision		Revision as of 14:52, 24 March 2026
Line 1:		Line 1:
	External Content component shows content from ~~other webpages~~ in dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the ~~content~~.		External Content component shows content from another webpage in the dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the website.

	By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' directive. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].		By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' directive. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].

	== External Content ~~Component Settings~~ ==		== External Content URL ==
	~~Following properties can be set on the Properties tab:~~		'''External content URL''' defines the URL of the external page you want to embed. You can also use a relative path (e.g. "/examples/test.html"), if the page you want to embed is accessible by the same protocol, host, and port.
	* '''Name''': Name of the External Content component.
	* '''Description''': Description for the External Content component.
	* '''External content URL'''~~: The~~ URL of the external page you want to embed. You can also use a relative path (e.g. "/examples/test.html"), if the page you want to embed is accessible by the same protocol, host, and port.

	== Passing Variables in Url==		== Passing Variables in Url==

Ollvihe at 22:21, 17 September 2025

2025-09-17T22:21:15Z

← Older revision		Revision as of 22:21, 17 September 2025
Line 1:		Line 1:
	External Content component shows content from other webpages in dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the content.		External Content component shows content from other webpages in dashboards. For example Microsoft Sharepoint or other content management systems can be integrated into QPR ProcessAnalyzer. The External Content component uses the HTML ''iframe'' element to embed the content.

	By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' directive. More information how to change the CSP setting: [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].		By default, only websites from the same origin than the QPR ProcessAnalyzer server can be embedded. This is restricted by the Content security policy (CSP) HTTP header ''child-src'' directive. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].

	== External Content Component Settings ==		== External Content Component Settings ==