History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: LPP-5532
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: P0 P0
Assignee: Max Carlson
Reporter: Lorien Henry-Wilkins
Votes: 0
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
OpenLaszlo

Iframe in iframemanager.js causes unsecure items warning in IE with SSL turned on

Created: 29/Feb/08 10:17 AM   Updated: 05/Mar/08 11:20 AM
Component/s: Browser Integration
Affects Version/s: Freya, RingDing (4.1)
Fix Version/s: RingDing (4.1), Mars

Time Tracking:
Not Specified

Severity: Blocker
Fixed in Change#: 8,147
Runtime: N/A
Fix in hand: True


 Description  « Hide
The iframe in the iframemanager is not initialized with a location so it defaults to about:blank. In IE 6.0 with SSL turned on about:blank will always resolve to http://about:blank, which cause the browser to throw a warning that the page is opening an unsecure resource. The Fix is simply to initialize the iframe with a URL such as 'javascript:""'. Without the wrapping quotes that's javascript : "". This does not throw the unsecure items warning. I think we should use this same mechanism in the history.js IE iframe rather than the current mechanism, which sets the source to a blank html page (blank.html). While this mechanism works, it requires the developer to make sure the blank.html page gets put in the deployment wherever embed-compressed.js is included (my suggestion, my bad).

So, my proposal is to change line 47 of lzhistory.js from

Lz.__setAttr(i, 'src', 'blank.html'); to

Lz.__setAttr(i, 'src', 'javascript:""');

and to add the same line to iframemanager.js when the iframe is created.

 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Amy Muntz - 29/Feb/08 04:56 PM
Changing "Fix Version" to Mars.

Max Carlson - 29/Feb/08 06:37 PM
Author: max
Date: 2008-02-29 18:35:20 -0800 (Fri, 29 Feb 2008)
New Revision: 8146

Removed:
   openlaszlo/trunk/lps/includes/blank.html
Modified:
   openlaszlo/trunk/lps/includes/source/iframemanager.js
   openlaszlo/trunk/lps/includes/source/lzhistory.js
Log:
Change 20080229-maxcarlson-S by maxcarlson@Roboto on 2008-02-29 15:42:21 PST
    in /Users/maxcarlson/openlaszlo/trunk-clean
    for http://svn.openlaszlo.org/openlaszlo/trunk

Summary: Fix html frame support with SSL.

New Features:

Bugs Fixed: LPP-5532: Iframe in iframemanager.js causes unsecure items warning in IE with SSL turned on

Technical Reviewer: promanik
QA Reviewer: lhenrywilkins@laszlosystems.com
Doc Reviewer: (pending)

Documentation:

Release Notes:

Details: Sending on behalf of Lorien with blank.html deleted from svn, and a minor typo fixed.

Need to initialize iframes that are used in the history mechanism and html tag to a value that will not be flagged as an unsecure item when the app is running with SSL. When no initial source value is set on an iframe it defaults to about:blank, which in IE resolves to http://about:blank even if the container page protocol is https.

Setting the initial source to javascript:"" solves the problem.
This change adds this initialization to the iframemanager, and changes the mechanism used in lzhistory
to be the one described above as it is a simpler solution. Previously in lzhistory.js the iframe source
was initialized to blank.html, which required a page called blank.html be available when the script
executes.
    

Tests: This can be tested by running the test case at lps/components/extensions/test/html-swf.jsp through
SSL in IE 6.0. Before this fix in in place you will get an unsecure content warning when the page loads.



Deleted: openlaszlo/trunk/lps/includes/blank.html

Modified: openlaszlo/trunk/lps/includes/source/iframemanager.js
===================================================================
--- openlaszlo/trunk/lps/includes/source/iframemanager.js 2008-03-01 02:32:24 UTC (rev 8145)
+++ openlaszlo/trunk/lps/includes/source/iframemanager.js 2008-03-01 02:35:20 UTC (rev 8146)
@@ -19,6 +19,8 @@
         if (name != "") Lz.__setAttr(i, 'name', name);
         this.__namebyid[id] = name;
 
+ Lz.__setAttr(iframe, 'src', 'javascript:""');
+
         if (appendto == null || appendto == "undefined") {
             appendto = document.body;
         }

Modified: openlaszlo/trunk/lps/includes/source/lzhistory.js
===================================================================
--- openlaszlo/trunk/lps/includes/source/lzhistory.js 2008-03-01 02:32:24 UTC (rev 8145)
+++ openlaszlo/trunk/lps/includes/source/lzhistory.js 2008-03-01 02:35:20 UTC (rev 8146)
@@ -44,7 +44,7 @@
             Lz.__setAttr(i, 'scrolling', 'no');
             Lz.__setAttr(i, 'width', '0');
             Lz.__setAttr(i, 'height', '0');
- Lz.__setAttr(i, 'src', 'blank.html');
+ Lz.__setAttr(i, 'src', 'javascript:""');
             document.body.appendChild(i);
             i = document.getElementById('lzHistory');
             _this._iframe = i;


_______________________________________________
Laszlo-checkins mailing list
Laszlo-checkins@openlaszlo.org
http://www.openlaszlo.org/mailman/listinfo/laszlo-checkins

Lorien Henry-Wilkins - 04/Mar/08 04:55 PM
I synched with the latest trunk in OL, and somehow the code in the iframemanage.js is not exactly what you gave me in the patches last week. I think the problem got injected when the changes were merged together. Line 22 is
Lz.__setAttr(iframe, 'src', 'javascript:""'); when it should be
Lz.__setAttr(i, 'src', 'javascript:""');

iframe in not defined until after the node has been added to the document, and we need to set the source before it is added to the document.

Lorien Henry-Wilkins - 04/Mar/08 04:56 PM
Making this a blocker because the bug breaks the iframe functionality.

Max Carlson - 05/Mar/08 11:20 AM
Author: max
Date: 2008-02-29 20:24:58 -0800 (Fri, 29 Feb 2008)
New Revision: 8147

Removed:
   openlaszlo/branches/pagan-deities/lps/includes/blank.html
Modified:
   openlaszlo/branches/pagan-deities/
   openlaszlo/branches/pagan-deities/lps/components/extensions/html.lzx
   openlaszlo/branches/pagan-deities/lps/components/extensions/test/html.lzx
   openlaszlo/branches/pagan-deities/lps/includes/source/embednew.js
   openlaszlo/branches/pagan-deities/lps/includes/source/iframemanager.js
   openlaszlo/branches/pagan-deities/lps/includes/source/lzhistory.js
Log:
Merged revisions 8144-8146 via svnmerge from
http://svn.openlaszlo.org/openlaszlo/trunk

.......
  r8144 | max | 2008-02-29 18:28:06 -0800 (Fri, 29 Feb 2008) | 26 lines
  
  Change 20080229-maxcarlson-Y by maxcarlson@Roboto on 2008-02-29 11:45:38 PST
      in /Users/maxcarlson/openlaszlo/trunk-clean
      for http://svn.openlaszlo.org/openlaszlo/trunk
  
  Summary: Fix html tag for wmode window in IE
  
  New Features:
  
  Bugs Fixed: LPP-5482 - Issue running swf in wmode "window" when using html tag
  
  Technical Reviewer: promanik
  QA Reviewer: lhenrywilkins@laszlosystems.com
  Doc Reviewer: (pending)
  
  Documentation:
  
  Release Notes:
  
  Details: embednew.js - Add Lz[appname]._getSWFDiv() API for use by iframemanager.
  
  iframemanager.js - Track __topiframe. Call __refresh() when Flash gets the focus, to ensure the iframe remains visible.
  
  
  Tests: See LPP-5482.
.......
  r8145 | max | 2008-02-29 18:32:24 -0800 (Fri, 29 Feb 2008) | 27 lines
  
  Change 20080229-maxcarlson-c by maxcarlson@Roboto on 2008-02-29 12:04:27 PST
      in /Users/maxcarlson/openlaszlo/trunk-clean
      for http://svn.openlaszlo.org/openlaszlo/trunk
  
  Summary: Add API to enable/disable history for the html tag
  
  New Features:
  
  Bugs Fixed: LPP-5530 - The history mechanism is incompatible with the html tag
  
  Technical Reviewer: promanik
  QA Reviewer: lhenrywilkins@laszlosystems.com
  Doc Reviewer: (pending)
  
  Documentation:
  
  Release Notes:
  
  Details: extensions/test/html.lzx - Add history attribute example.
  
  extensions/html.lzx - Add history attribute to html tag. If true, iframe chagnes will be added to the browser history. If false, iframe reloads are not added.
  
  iframemanager.js - Set frame name based on id if not specified. Store frame names for lookup for in setSrc().
      
  Tests: Change the history attribute in extensions/test/html.lzx to false and notice that reloading addresses doesn't add browser history entries.
.......
  r8146 | max | 2008-02-29 18:35:20 -0800 (Fri, 29 Feb 2008) | 33 lines
  
  Change 20080229-maxcarlson-S by maxcarlson@Roboto on 2008-02-29 15:42:21 PST
      in /Users/maxcarlson/openlaszlo/trunk-clean
      for http://svn.openlaszlo.org/openlaszlo/trunk
  
  Summary: Fix html frame support with SSL.
  
  New Features:
  
  Bugs Fixed: LPP-5532: Iframe in iframemanager.js causes unsecure items warning in IE with SSL turned on
  
  Technical Reviewer: promanik
  QA Reviewer: lhenrywilkins@laszlosystems.com
  Doc Reviewer: (pending)
  
  Documentation:
  
  Release Notes:
  
  Details: Sending on behalf of Lorien with blank.html deleted from svn, and a minor typo fixed.
  
  Need to initialize iframes that are used in the history mechanism and html tag to a value that will not be flagged as an unsecure item when the app is running with SSL. When no initial source value is set on an iframe it defaults to about:blank, which in IE resolves to http://about:blank even if the container page protocol is https.
  
  Setting the initial source to javascript:"" solves the problem.
  This change adds this initialization to the iframemanager, and changes the mechanism used in lzhistory
  to be the one described above as it is a simpler solution. Previously in lzhistory.js the iframe source
  was initialized to blank.html, which required a page called blank.html be available when the script
  executes.
      
  
  Tests: This can be tested by running the test case at lps/components/extensions/test/html-swf.jsp through
  SSL in IE 6.0. Before this fix in in place you will get an unsecure content warning when the page loads.
.......



Property changes on: openlaszlo/branches/pagan-deities
___________________________________________________________________
Name: svnmerge-integrated
   - /openlaszlo/branches/paperpie:1-6504,6506-6574,6576-7135,7137-7235 /openlaszlo/branches/wafflecone:1-5746,5818-6068,6070-6205,6207-6213,6216-6265,6267-6368,6370-6431,6433-6450,6497,6509,6661,7097,7872 /openlaszlo/trunk:1-7950,7983,8021,8062
   + /openlaszlo/branches/paperpie:1-6504,6506-6574,6576-7135,7137-7235 /openlaszlo/branches/wafflecone:1-5746,5818-6068,6070-6205,6207-6213,6216-6265,6267-6368,6370-6431,6433-6450,6497,6509,6661,7097,7872 /openlaszlo/trunk:1-7950,7983,8021,8062,8144-8146

Modified: openlaszlo/branches/pagan-deities/lps/components/extensions/html.lzx
===================================================================
--- openlaszlo/branches/pagan-deities/lps/components/extensions/html.lzx 2008-03-01 02:35:20 UTC (rev 8146)
+++ openlaszlo/branches/pagan-deities/lps/components/extensions/html.lzx 2008-03-01 04:24:58 UTC (rev 8147)
@@ -1,5 +1,5 @@
 <!-- * X_LZ_COPYRIGHT_BEGIN ***************************************************
-* Copyright 2007 Laszlo Systems, Inc. All Rights Reserved. *
+* Copyright 2007-2008 Laszlo Systems, Inc. All Rights Reserved. *
 * Use is subject to license terms. *
 * X_LZ_COPYRIGHT_END ****************************************************** -->
 
@@ -22,8 +22,8 @@
     ,setPosition: function(id, x, y, width, height, v) {
         LzBrowser.callJS('Lz.iframemanager.setPosition', false, id, x, y, width, height, v);
     }
- ,setSrc: function(id, src) {
- LzBrowser.callJS('Lz.iframemanager.setSrc', null, id, src);
+ ,setSrc: function(id, src, history) {
+ LzBrowser.callJS('Lz.iframemanager.setSrc', null, id, src, history);
     }
     ,setVisible: function(id, v) {
         LzBrowser.callJS('Lz.iframemanager.setVisible', false, id, v);
@@ -49,8 +49,8 @@
     <attribute name="heightoffset" type="number" value="0"/>
     <attribute name="loading" type="boolean" value="false"/>
     <attribute name="appendto" value="null"/>
- <attribute name="iframe" value="null"/>
     <attribute name="ready" value="false"/>
+ <attribute name="history" value="true"/>
 
     <attribute name="target" value="null" setter="this.setTarget(target)"/>
     <attribute name="framename" value="" type="string"/>
@@ -86,7 +86,7 @@
         this.src = s;
         this.setAttribute('loading', true);
         if (this['iframeid']) {
- Lz.iframemanager.setSrc(this.iframeid, s);
+ Lz.iframemanager.setSrc(this.iframeid, s, this.history);
         } else {
             this.srcset = s;
         }
@@ -120,7 +120,7 @@
         this.iframeid = id;
         this.__updatepos();
         if (this['isfront']) this.bringToFront();
- if (this['srcset']) Lz.iframemanager.setSrc(id, this.srcset);
+ if (this['srcset']) Lz.iframemanager.setSrc(id, this.srcset, this.history);
         this.setAttribute('ready', true);
     </method>
     <method name="__gotload">

Modified: openlaszlo/branches/pagan-deities/lps/components/extensions/test/html.lzx
===================================================================
--- openlaszlo/branches/pagan-deities/lps/components/extensions/test/html.lzx 2008-03-01 02:35:20 UTC (rev 8146)
+++ openlaszlo/branches/pagan-deities/lps/components/extensions/test/html.lzx 2008-03-01 04:24:58 UTC (rev 8147)
@@ -1,5 +1,5 @@
 <!-- * X_LZ_COPYRIGHT_BEGIN ***************************************************
-* Copyright 2007 Laszlo Systems, Inc. All Rights Reserved. *
+* Copyright 2007-2008 Laszlo Systems, Inc. All Rights Reserved. *
 * Use is subject to license terms. *
 * X_LZ_COPYRIGHT_END ****************************************************** -->
 <canvas width="100%" height="100%">
@@ -21,7 +21,7 @@
             </method>
         </button>
         <text name="status" y="3" fontstyle="bold" visible="${parent.main.loading}">Loading...</text>
- <html name="main" heightoffset="-74" widthoffset="-19" xoffset="7" yoffset="50">
+ <html name="main" heightoffset="-74" widthoffset="-19" xoffset="7" yoffset="50" history="true">
             <method event="oninit">
                 this.bringToFront();
             </method>

Deleted: openlaszlo/branches/pagan-deities/lps/includes/blank.html

Modified: openlaszlo/branches/pagan-deities/lps/includes/source/embednew.js
===================================================================
--- openlaszlo/branches/pagan-deities/lps/includes/source/embednew.js 2008-03-01 02:35:20 UTC (rev 8146)
+++ openlaszlo/branches/pagan-deities/lps/includes/source/embednew.js 2008-03-01 04:24:58 UTC (rev 8147)
@@ -2,7 +2,7 @@
   * @topic Browser
   * @subtopic Integration
   * @access public
- * @copyright Copyright 2001-2007 Laszlo Systems, Inc. All Rights Reserved.
+ * @copyright Copyright 2001-2008 Laszlo Systems, Inc. All Rights Reserved.
   * Use is subject to license terms.
   */
   
@@ -113,6 +113,7 @@
             ,_ready: Lz._ready
             // List of functions to call when the app is loaded
             ,_onload: []
+ ,_getSWFDiv: Lz._getSWFDiv
             ,loaded: false
             ,_sendMouseWheel: Lz._sendMouseWheel
             ,_setCanvasAttributeDequeue: Lz._setCanvasAttributeDequeue
@@ -595,6 +596,10 @@
         return root;
     }
     ,/** @access private */
+ _getSWFDiv: function() {
+ return dojo.flash.obj.get();
+ }
+ ,/** @access private */
     _sendMouseWheel: function(d) {
         if (d != null) this.callMethod("LzKeys.__mousewheelEvent(" + d + ")");
     }

Modified: openlaszlo/branches/pagan-deities/lps/includes/source/iframemanager.js
===================================================================
--- openlaszlo/branches/pagan-deities/lps/includes/source/iframemanager.js 2008-03-01 02:35:20 UTC (rev 8146)
+++ openlaszlo/branches/pagan-deities/lps/includes/source/iframemanager.js 2008-03-01 04:24:58 UTC (rev 8147)
@@ -1,10 +1,11 @@
 /* X_LZ_COPYRIGHT_BEGIN ***************************************************
-* Copyright 2001-2007 Laszlo Systems, Inc. All Rights Reserved. *
+* Copyright 2001-2008 Laszlo Systems, Inc. All Rights Reserved. *
 * Use is subject to license terms. *
 * X_LZ_COPYRIGHT_END ******************************************************/
 Lz.iframemanager = {
     __highestz: 0
     ,__frames: {}
+ ,__namebyid: {}
     ,create: function(owner, name, appendto) {
         //alert(owner + ', ' + name + ', ' + appendto)
         var i = document.createElement('iframe');
@@ -14,9 +15,12 @@
         var id = '__lz' + Lz.iframemanager.__highestz++;
         Lz.iframemanager.__frames[id] = i;
 
- if (name == null) name = '';
+ if (name == null || name == 'null') name = id;
         if (name != "") Lz.__setAttr(i, 'name', name);
+ this.__namebyid[id] = name;
 
+ Lz.__setAttr(iframe, 'src', 'javascript:""');
+
         if (appendto == null || appendto == "undefined") {
             appendto = document.body;
         }
@@ -28,11 +32,21 @@
         iframe.__gotload = Lz.iframemanager.__gotload;
         iframe._defaultz = 99900 + Lz.iframemanager.__highestz;
         iframe.style.zIndex = iframe._defaultz;
+
+ Lz.iframemanager.__topiframe = id;
         if (document.getElementById && !(document.all) ) {
             iframe.style.border = '0';
         } else if (document.all) {
+ // IE
             Lz.__setAttr(iframe, 'border', '0');
             Lz.__setAttr(iframe, 'allowtransparency', 'true');
+
+ var metadata = Lz[iframe.owner]
+ if (metadata.runtime == 'swf') {
+ // register for onfocus event for swf movies - see LPP-5482
+ var div = metadata._getSWFDiv();
+ div.onfocus = Lz.iframemanager.__refresh;
+ }
         }
         iframe.style.position = 'absolute';
         return id + '';
@@ -40,12 +54,20 @@
     ,getFrame: function(id) {
         return Lz.iframemanager.__frames[id];
     }
- ,setSrc: function(id, s) {
+ ,setSrc: function(id, s, history) {
         //console.log('setSrc', id, s)
- var iframe = Lz.iframemanager.getFrame(id);
- if (! iframe) return;
- Lz.__setAttr(iframe, 'src', s);
- return true;
+ if (history) {
+ var iframe = Lz.iframemanager.getFrame(id);
+ if (! iframe) return;
+ Lz.__setAttr(iframe, 'src', s);
+ return true;
+ } else {
+ var id = Lz.iframemanager.__namebyid[id];
+ var iframe = window[id];
+ if (! iframe) return;
+ iframe.location.replace(s);
+ return true;
+ }
     }
     ,setPosition: function(id, x, y, width, height, visible) {
         //Debug.write('setPosition', id);
@@ -74,7 +96,6 @@
         var iframe = Lz.iframemanager.getFrame(id);
         if (! iframe) return;
         iframe.style.display = v ? 'block' : 'none';
- this._visible = v;
         return true;
     }
     ,bringToFront: function(id) {
@@ -83,6 +104,7 @@
         var iframe = Lz.iframemanager.getFrame(id);
         if (! iframe) return;
         iframe.style.zIndex = 100000 + Lz.iframemanager.__highestz;
+ Lz.iframemanager.__topiframe = id;
         return true;
     }
     ,sendToBack: function(id) {
@@ -110,4 +132,14 @@
             Lz[iframe.owner].callMethod('Lz.iframemanager.__gotload(\'' + id + '\')');
         }
     }
+ ,__refresh: function() {
+ // called in IE for onfocus event in swf - see LPP-5482
+ if (Lz.iframemanager.__topiframe) {
+ var iframe = Lz.iframemanager.getFrame(Lz.iframemanager.__topiframe);
+ if (iframe.style.display == 'block') {
+ iframe.style.display = 'none';
+ iframe.style.display = 'block';
+ }
+ }
+ }
 }

Modified: openlaszlo/branches/pagan-deities/lps/includes/source/lzhistory.js
===================================================================
--- openlaszlo/branches/pagan-deities/lps/includes/source/lzhistory.js 2008-03-01 02:35:20 UTC (rev 8146)
+++ openlaszlo/branches/pagan-deities/lps/includes/source/lzhistory.js 2008-03-01 04:24:58 UTC (rev 8147)
@@ -44,7 +44,7 @@
             Lz.__setAttr(i, 'scrolling', 'no');
             Lz.__setAttr(i, 'width', '0');
             Lz.__setAttr(i, 'height', '0');
- Lz.__setAttr(i, 'src', 'blank.html');
+ Lz.__setAttr(i, 'src', 'javascript:""');
             document.body.appendChild(i);
             i = document.getElementById('lzHistory');
             _this._iframe = i;


_______________________________________________
Laszlo-checkins mailing list
Laszlo-checkins@openlaszlo.org
http://www.openlaszlo.org/mailman/listinfo/laszlo-checkins