Garthanos / geoxml

Automatically exported from code.google.com/p/geoxml
1 stars 0 forks source link

refering to "top" can give XSS errors in firefox #10

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
>What steps will reproduce the problem?
1. create a map with geoxml as per the docs
2. place the map inside an iframe on a different domain

>What is the expected output? What do you see instead?
It works in IE and Safari. In Firefox, it will complain 
"permission denied to get topwdw.publishdirectory" - in
mozillaspeak. Mozilla is ofcourse right (I'm surprised
it works in other browsers).

>What version of the product are you using? On what operating system?
7 may 2009, Firefox 2

>Please provide any additional information below.

I did a search and replace on "top." to "topwdw". declared on global
var topwdw = self. That worked. By doing this, I am obviously missing 
some features that can apparently be set in a top window. 

where I define the var topwdw, there could be a try - catch to
see if the client is allowed to get to the top window's properties.

Original issue reported on code.google.com by pike-common@kw.nl on 15 May 2009 at 5:38

GoogleCodeExporter commented 9 years ago
Some features like parsing the url also 
use reference to the top window I may put
in a setting to indicate which window url
if any you want it to parse or get other 
settings from.

Original comment by lanceala...@gmail.com on 16 May 2009 at 1:49

GoogleCodeExporter commented 9 years ago
Hi pvankemenade,

could you post your edited file as my map depends heavily on people being able 
to
embed it. I've tried editing the file myself but am having problems as i've a 
JS newb.

Thanks.

Original comment by robinpel...@gmail.com on 20 Jul 2009 at 3:30

GoogleCodeExporter commented 9 years ago

Original comment by lanceala...@gmail.com on 19 Sep 2009 at 11:58

GoogleCodeExporter commented 9 years ago
good work ! thanks !

Original comment by pike-common@kw.nl on 19 Sep 2009 at 2:35