If Switch back to http pages when there are no matches is in securepages is active the img_assist popup/gallery window has no content.

Tested on Linux Firefox 1.5.x.x, and Linux Opera 9.00.

Thist issue doesn't affect Konqueror 3.5.x.

I don't know if this is a problem of securepages or of img_assist so I report this issue to both.

Comments

rblomme@drupal.org’s picture

If securepages module is enabled, I cannot insert an image as "HTML code". There is no error message, but nothing happens. Insert mode "Filter tag" works fine. No problems if securepages is disabled.
Tested with firefox 1.0.8.
No problems with konqueror.

// $Id: img_assist.module,v 1.56.2.5 2006/05/04 21:35:40 bjshell Exp $

rblomme@drupal.org’s picture

In the javascript console of firefox, an error message appears:
Error: uncaught exception: Permission denied to get property Window.tinyMCE
Error: uncaught exception: Permission denied to get property Window.insertImage

Any ideas?

rblomme@drupal.org’s picture

administer -> settings -> securepages -> Pages which will be secure
"show only on the listed pages"

Add:
img_assist/*
disknode/*

and my problem is solved.

The FAQ on http://developer.mozilla.org/en/docs/DOM:window.open reads
" I can not access the properties of the new secondary window. I always get an error in the javascript console saying "Error: uncaught exception: Permission denied to get property
. Why is that?
It is because of the cross-domain script security restriction (also referred as the "Same Origin Policy"). A script loaded in a window (or frame) from a distinct origin (domain name) cannot get nor set properties of another window (or frame) or the properties of any of its HTML objects coming from another distinct origin (domain name). Therefore, before executing a script targeting a secondary window, the browser in the main window will verify that the secondary window has the same domain name.
More reading on the cross-domain script security restriction: http://www.mozilla.org/projects/security/components/same-origin.html"

Pages with http and https are not considered to be from the "Same Origin". Since the securepages module forces node/*/edit pages to have https, we also have to make sure that img_assist/* (and disknode/*) pages and windows have https.

I still do not understand why this issue does not affect Konqueror. Is this "Same Origin Policy" not implemented in Konqueror? Why not?

darren oh’s picture

Status: Active » Closed (fixed)