search

devlabnet / SlideShow

SlideShow Plugin for CKEditor
16 stars 18 forks source link

x-xss error on adding link with jquery to head #2

Closed yeahaa closed 8 years ago

yeahaa commented 11 years ago

hello, i get the error "The XSS Auditor refused to execute a script because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header." at: var scriptFancyBoxCss = CKEDITOR.document.createElement( 'script', { attributes: { type: 'text/javascript' } }); scriptFancyBoxCss.setText("$('head').append('<link rel=\"stylesheet\" href=\""+CSS_FANCYBOX+"\" type=\"text/css\" />');"); slideshowDOM.append(scriptFancyBoxCss);

I suggest changing this to: var scriptFancyBoxCss = CKEDITOR.document.createElement( 'link', { attributes: { type: 'text/css', href: CSS_FANCYBOX } }); slideshowDOM.append(scriptFancyBoxCss); or something alike that works? (did not test the suggestion)

ikurennyi commented 10 years ago

Hey guys! The same problem with "The XSS Auditor refused to execute a script in 'path_to_image' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header." Any ideas?..

Usually this happened when I'm submitting a form. But error's gone after page's refreshing.