From 479f083ab8ec405d1b8296b32a20262f6192a1f9 Mon Sep 17 00:00:00 2001
From: Meier Lukas <meierschlumpf@gmail.com>
Date: Sat, 13 Dec 2025 11:50:33 +0100
Subject: [PATCH] fix(iframe-widget): permission selection not applying to any
 origin (#4616)

---
 packages/widgets/src/iframe/component.tsx | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/packages/widgets/src/iframe/component.tsx b/packages/widgets/src/iframe/component.tsx
index 760c46b03..67fa73536 100644
--- a/packages/widgets/src/iframe/component.tsx
+++ b/packages/widgets/src/iframe/component.tsx
@@ -27,7 +27,7 @@ export default function IFrameWidget({ options, isEditMode }: WidgetComponentPro
         className={classes.iframe}
         src={embedUrl}
         title="widget iframe"
-        allow={allowedPermissions.join(" ")}
+        allow={allowedPermissions}
         scrolling={allowScrolling ? "yes" : "no"}
         sandbox={sandboxFlags.join(" ")}
       >
@@ -77,9 +77,13 @@ const UnsupportedProtocol = () => {
 const getAllowedPermissions = (
   permissions: Omit<WidgetComponentProps<"iframe">["options"], "embedUrl" | "allowScrolling">,
 ) => {
-  return objectEntries(permissions)
-    .filter(([_key, value]) => value)
-    .map(([key]) => permissionMapping[key]);
+  return (
+    objectEntries(permissions)
+      .filter(([_key, value]) => value)
+      // * means it applies to all origins
+      .map(([key]) => `${permissionMapping[key]} *`)
+      .join("; ")
+  );
 };
 
 const getSandboxFlags = (