Skip to content

Allow downloading files in read-only iframe embeds #307

Closed

Description

@waseeen

When opening a document in a read-only iframe, download controls remain available and generate a file, but no download starts. This gives the impression that the controls are malfunctioning.

Steps to reproduce

  1. Open a document inside an iframe using /editor?src=<document-url>&readonly=1&embed=1.

  2. Select a download/export option in the File tab.

  3. Observe that no file is downloaded, although the console reports:

    [OO] file stream received: example.xlsx (22394 bytes)
    

Expected behavior

Read-only mode should allow downloading without enabling editing:

  • Keep download controls functional when downloading is permitted.
  • Allow downloading to be configured independently of editing permissions.
  • Hide or visibly disable download controls when downloading is unavailable.

Implementation context

In lib/onlyoffice/save-stream.ts, routeSavedFile() skips local downloads in embed mode and recommends using document:save from the parent page. However, requestSaveDocument() rejects that command when the document is read-only.

Removing embed=1 does not change this behavior because lib/embed-mode.ts automatically detects iframe embedding.

Could downloading be supported independently of editing in read-only embeds? Allowing local downloads through an explicit option, or providing an API command that permits exporting a read-only document, would both address the issue.

Activity

  1. chaxus commented on Nov 6, 2026

    @chaxus
    Member

    Thanks for the clear report and the pointer into routeSavedFile / requestSaveDocument — that was exactly the double bind.

    Fixed in #308 and live on https://edit.chaxus.com/

    What changed:

    • Read-only no longer blocks export: document:save / requestSaveDocument work on locked documents (edit stays off).
    • In embed mode, if the parent does not claim the File-tab download via document:save, the bytes are downloaded locally instead of being dropped (and the host dirty flag is left alone).

    So with /editor?src=…&readonly=1&embed=1, File → Download should produce a real file again. Parent pages can still use document:save when they want the File themselves.

    Sorry for the confusing “controls work but nothing happens” behavior — appreciate you writing it up so precisely.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions