disable remote embedding by default

3 years ago · d405a5f086
parent 87f6f97cca
commit d405a5f086
1 changed files with 3 additions and 0 deletions
--- a/lib/env.js
+++ b/lib/env.js
@ -153,6 +153,9 @@ module.exports.create = function (config) {
            }
        },

+        // as of 4.14.0 you need to opt-in to remote embedding.
+        disableEmbedding: true,
+
 /*  FIXME restrictRegistration is initialized as false and then overridden by admin decree
    There is a narrow window in which someone could register before the server updates this value.
    See also the cached 'restrictRegistration' value in server.js#serveConfig