diff --git a/www/common/diffMarked.js b/www/common/diffMarked.js
index ff13b95e0..02a9782b0 100644
--- a/www/common/diffMarked.js
+++ b/www/common/diffMarked.js
@@ -447,11 +447,17 @@ define([
         if (restrictedTags.indexOf(root.nodeName.toUpperCase()) === -1) { return true; }
         return root.getAttribute && /^(blob\:|\/lib\/pdfjs)/.test(root.getAttribute('src'));
     };
+    // Remove any iframe with srcdoc attribute
+    var checkSrcDoc = function (root) {
+        if (restrictedTags.indexOf(root.nodeName.toUpperCase()) === -1) { return true; }
+        return !(root.getAttribute && root.getAttribute('srcdoc'));
+    };
 
     var removeForbiddenTags = function (root) {
         if (!root) { return; }
         if (forbiddenTags.indexOf(root.nodeName.toUpperCase()) !== -1) { removeNode(root); }
-        if (!checkSrc(root)) { removeNode(root); }
+        if (!checkSrc(root)) { removeNode(root); }
+        if (!checkSrcDoc(root)) { removeNode(root); }
         slice(root.children).forEach(removeForbiddenTags);
     };
 
diff --git a/www/common/jscolor.js b/www/common/jscolor.js
index b1ac6ed8e..a14df6313 100644
--- a/www/common/jscolor.js
+++ b/www/common/jscolor.js
@@ -14,6 +14,8 @@
  * See usage examples at http://jscolor.com/examples/
  */
 
+// NOTE: custom changes for CryptPad:
+// - "new Function" code has been commented out for security reasons
 
 "use strict";
 
@@ -62,6 +64,7 @@ var jsc = {
 				}
 
 				var opts = {};
+/*
 				if (optsStr) {
 					try {
 						opts = (new Function ('return (' + optsStr + ')'))();
@@ -69,6 +72,7 @@ var jsc = {
 						jsc.warn('Error parsing jscolor options: ' + eParseError + ':\n' + optsStr);
 					}
 				}
+*/
 				targetElm.jscolor = new jsc.jscolor(targetElm, opts);
 			}
 		}
@@ -685,11 +689,11 @@ var jsc = {
 	dispatchFineChange : function (thisObj) {
 		if (thisObj.onFineChange) {
 			var callback;
-			if (typeof thisObj.onFineChange === 'string') {
-				callback = new Function(thisObj.onFineChange);
-			} else {
+//			if (typeof thisObj.onFineChange === 'string') {
+//				callback = new Function(thisObj.onFineChange);
+//			} else {
 				callback = thisObj.onFineChange;
-			}
+//			}
 			callback(thisObj);
 		}
 	},