Preview: Add allow-forms to iframe sandbox attributes

[rickbutterfield]

Description

When viewing a page in Preview mode and attempting to submit a form (either a standard form POST or Umbraco Forms), an error occurs in the browser console and the form is not submitted:

Blocked form submission to '/form-submission-endpoint' because the form's frame is sandboxed and the 'allow-forms' permission is not set.

Umbraco Forms allows content editors to "Save and preview" forms from the backoffice, and we are aware of users that do test their forms this way.

This PR resolves that issue by adding the allow-forms value to the preview iframe's sandbox attribute.

Testing

This can be replicated on a blank install of CMS with the Starter Kit (both in 16.3.4 and 17.0.0-rc1)

dotnet new install [email protected]
dotnet new umbraco --name TestProject
cd .\TestProject\
dotnet add package Umbraco.TheStarterKit --version 16.0.0
dotnet run

Once Umbraco is installed and running:

• navigate to the Contact page in the backoffice
• press the "Save and preview" button
• On the loaded Contact page preview, open the dev tools
• Fill out the form and attempt to submit it

Observe that the error listed above shows in the dev tools console.

[Copilot]

Pull Request Overview

This PR enhances the preview iframe's sandbox permissions by adding form submission capability. The change enables forms within the preview iframe to function properly, which is essential for testing user interactions in the preview environment.

Key changes:

• Added allow-forms attribute to the iframe sandbox permissions

[AndyButland]

Thanks @rickbutterfield - will merge this in for 17.1 and cherry-pick it to also be part of 16.4.