My way to solve this is that one:
In index.hml(or where you have the embedpano() )
In var 'direction' you ask if location is diferent to parent.location. If so, it means that the tour is inside an iframe, so you give it the route for iframes. Other ways you give it the route for the non iframe.
In the embedpano(), inside initvars you create a variable (BASEDIRPANOS) and give it the value of 'the var 'direction'
var direction = window.location !== window.parent.location ? 'iframerute' : 'panosrute'
embedpano({
....
initvars: {
BASEDIRPANOS:direction,
},
....
})
in tour.xml you have to repalace the normal 'panos/' with this initvar like this: %$BASEDIRPANOS%
<scene name="scene_01" title="scene_01" onstart="" thumburl="%$BASEDIRPANOS%/shutterstock_1806442003.tiles/thumb.jpg" lat="" lng="" heading="">
<control bouncinglimits="calc:image.cube ? true : false" />
<view hlookat="0.0" vlookat="0.0" fovtype="MFOV" fov="120" maxpixelzoom="2.0" fovmin="70" fovmax="140" limitview="auto" />
<preview url="%$BASEDIRPANOS%/shutterstock_1806442003.tiles/preview.jpg" />
<image>
<cube url="%$BASEDIRPANOS%/shutterstock_1806442003.tiles/%s/l%l/%v/l%l_%s_%v_%h.jpg" multires="512,640,1280,2560" />
</image>
</scene>
And that's it!
If you want to block all the content, use the same logic with the whole krpano embedpano({...}) with an if function.
if ( window.location === window.parent.location) {
embedpano({
....
})
}
* i don't know if this is a crossbrwoser solution