Closed (fixed)
Project:
Image Assist
Version:
4.7.x-1.x-dev
Component:
Code
Priority:
Minor
Category:
Bug report
Assigned:
Reporter:
Created:
2 Aug 2006 at 15:48 UTC
Updated:
28 Nov 2006 at 19:02 UTC
If Switch back to http pages when there are no matches is in securepages is active the img_assist popup/gallery window has no content.
Tested on Linux Firefox 1.5.x.x, and Linux Opera 9.00.
Thist issue doesn't affect Konqueror 3.5.x.
I don't know if this is a problem of securepages or of img_assist so I report this issue to both.
Comments
Comment #1
rblomme@drupal.org commentedIf securepages module is enabled, I cannot insert an image as "HTML code". There is no error message, but nothing happens. Insert mode "Filter tag" works fine. No problems if securepages is disabled.
Tested with firefox 1.0.8.
No problems with konqueror.
// $Id: img_assist.module,v 1.56.2.5 2006/05/04 21:35:40 bjshell Exp $
Comment #2
rblomme@drupal.org commentedIn the javascript console of firefox, an error message appears:
Error: uncaught exception: Permission denied to get property Window.tinyMCE
Error: uncaught exception: Permission denied to get property Window.insertImage
Any ideas?
Comment #3
rblomme@drupal.org commentedadminister -> settings -> securepages -> Pages which will be secure
"show only on the listed pages"
Add:
img_assist/*
disknode/*
and my problem is solved.
The FAQ on http://developer.mozilla.org/en/docs/DOM:window.open reads
" I can not access the properties of the new secondary window. I always get an error in the javascript console saying "Error: uncaught exception: Permission denied to get property
. Why is that?
It is because of the cross-domain script security restriction (also referred as the "Same Origin Policy"). A script loaded in a window (or frame) from a distinct origin (domain name) cannot get nor set properties of another window (or frame) or the properties of any of its HTML objects coming from another distinct origin (domain name). Therefore, before executing a script targeting a secondary window, the browser in the main window will verify that the secondary window has the same domain name.
More reading on the cross-domain script security restriction: http://www.mozilla.org/projects/security/components/same-origin.html"
Pages with http and https are not considered to be from the "Same Origin". Since the securepages module forces node/*/edit pages to have https, we also have to make sure that img_assist/* (and disknode/*) pages and windows have https.
I still do not understand why this issue does not affect Konqueror. Is this "Same Origin Policy" not implemented in Konqueror? Why not?
Comment #4
darren oh