Asynchronous doesn't display Access Denied pages

And here is the patch :)

Hi recidive,
this

+          var data = eval("(" + xhr.responseText + ")");

was taken (and adapted) from jQuery's source code (version 1.3.2 line 3724):

			if ( type == "json" )
				data = window["eval"]("(" + data + ")");

So this is the same as doing $.ajax request of type json.

That being said, a little bit of more research I found out this: http://www.json.org/js.html:

To convert a JSON text into an object, you can use the eval() function. eval() invokes the JavaScript compiler. Since JSON is a proper subset of JavaScript, the compiler will correctly parse the text and produce an object structure. The text must be wrapped in parens to avoid tripping on an ambiguity in JavaScript's syntax.

var myObject = eval('(' + myJSONtext + ')');
The eval function is very fast. However, it can compile and execute any JavaScript program, so there can be security issues. The use of eval is indicated when the source is trusted and competent. It is much safer to use a JSON parser. In web applications over XMLHttpRequest, communication is permitted only to the same origin that provide that page, so it is trusted. But it might not be competent. If the server is not rigorous in its JSON encoding, or if it does not scrupulously validate all of its inputs, then it could deliver invalid JSON text that could be carrying dangerous script. The eval function would execute the script, unleashing its malice.

To defend against this, a JSON parser should be used. A JSON parser will recognize only JSON text, rejecting all scripts. In browsers that provide native JSON support, JSON parsers are also much faster than eval. It is expected that native JSON support will be included in the next ECMAScript standard.

Even that json.org says that eval is not safe, in our case it is "safe" enough. If someone gets to inject JS on the server side then we have bigger problems anyway.

Maybe we should add a simple alert() saying some error ocurred for now?

I think that maybe having the "Loading..." message at the top of the page saying something like "We're sorry, an error occured. Please try to refresh your page" might be better :)

Cheers

Yes,
I'll resubmit this night or tomorrow another patch :)

cheers

Here it is.

Cheers