Hello and welcome to our community! Is this your first visit?
Register
Enjoy an ad free experience by logging in. Not a member yet? Register.
Results 1 to 3 of 3
  1. #1
    New to the CF scene
    Join Date
    Jan 2004
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Setting onunload across frames

    I am trying to set the onunload event handler of one frame from another. It only works with local files, and not with outside websites, even when I request enhanced privileges.

    Example follows:

    frameset.html:
    <html>
    <frameset cols="10%,*" frameborder="1">
    <frame name="leftframe" src="left.html">
    <frame name="rightframe" src="http://google.com">
    </frameset>
    </html>

    left.html:
    <html>
    <script>
    function unloading() {
    alert("unloading!");
    }
    function set_onunload() {
    try{
    netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
    parent.rightframe.onunload = unloading;
    }
    catch(e){
    alert("Error : Can't set onunload!");
    }
    }
    </script>

    <a href="left.html" onClick="javascript:set_onunload()">Set onunload!</a>
    </html>

    If the external url in the righthand frame is replaced with a local file, the script works correctly, displaying the alert when the right hand frame unloads. With a nonlocal file though, the frame does not show an alert when unloading.

    I'm using Mozilla 1.2.1.

    Any guidance would be greatly appreciated.
    Last edited by khuffenb; 01-07-2004 at 05:33 AM.

  • #2
    Supreme Master coder! glenngv's Avatar
    Join Date
    Jun 2002
    Location
    Philippines
    Posts
    11,068
    Thanks
    0
    Thanked 256 Times in 252 Posts
    If both frames are in the same domain (local or not), you don't have to ask browser privileges to set event handlers from one frame to the other. But it's not possible if they are from different domains. Granting it's possible, it would probably be a vulnerability exploit. Imagine if you could do that in any external sites, it would create havoc. You don't want your site to be controlled by other sites, do you?
    Glenn
    ____________________________________

    My Blog
    Tower of Hanoi Android app (FREE!)
    Tower of Hanoi Leaderboard
    Samegame Facebook App
    vBulletin Plugins
    ____________________________________

  • #3
    New to the CF scene
    Join Date
    Jan 2004
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    For my application, the frames are in different domains. This cannot be helped. I realize I will have to have the user grant privileges to this script. However, I do not intend to have the user grant any privileges to the foreign domain.

    As long as the trusted domain is secure and has no malicious scripts, I think this mitigates the security risk.


  •  

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •