[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kfm-devel
Subject:    Re: javascript frame reload problem
From:       David Faure <david () mandrakesoft ! com>
Date:       2002-03-22 2:17:54
[Download RAW message or body]

On Thursday 21 March 2002 19:02, Jelmer Feenstra wrote:
> On Thursday 21 March 2002 18:30, David Faure wrote:
> > On Thursday 21 March 2002 18:22, Jelmer Feenstra wrote:
> <cut>
> > > Any idea ? David ?
> >
> > The error message is quite self-explanatory, isn't it ?
> > Does it work in any other browser?
> 
> Yes it works in almost every browser I know of. And as I also stated it used 
> to work without problems in konq 2.2.2 as well.

Ok, I know why this happens. Not an easy fix though :(

Your setup is
* Frameset, www.jelmer.cc
*     One frame, http://niihau.student.utwente.nl/~spark/index.php
*     That frame opens a window, http://niihau.student.utwente.nl/~spark/login.php
That last window (let's call it login) wants to access the frame (let's call it index).

The security check for cross-frame access used to be "compare the hostnames in the URLs" 
in KDE 2, so login and index could "talk" just fine.
However the JS spec doesn't say "you should compare the URLs", it says we should
compare domains. The domain defaults to the URL, but can be enlarged
(niihau.student.utwente.nl -> student.utwente.nl for instance, using document.domain=blah).
The domain is also set to the one of the parent frameset for a frame, and to the one
of the opener for window.open.

So what should happen - and is probably what happens in other browsers, is:
the frameset sets domain=www.jelmer.cc on the index frame,
and that frame sets the same domain on the login window. So here again 'login'
and 'index' can talk.

Konqueror tries to do that, but when it sets the domain onto the new login window,
it does so right after creating the window (while it's still empty), and then opens
the URL in the window - which deletes the DocumentImpl and creates a new
one, whose domain isn't set.
Due to the asynchronous nature of window.open we can't just set the domain
from the window.open implementation.
Either the domain should be kept between openURL calls in the part (but somehow 
I doubt that)... or we should find a way to set the domain after opening the URL.
The only way I can think of is to extend URLArgs ... and that's why it's not an easy fix.

Dirk, Simon... ? Any ideas/comments ?

-- 
David FAURE, david@mandrakesoft.com, faure@kde.org
http://people.mandrakesoft.com/~david/, http://www.konqueror.org/
KDE, Making The Future of Computing Available Today
[prev in list] [next in list] [prev in thread] [next in thread]