Frames and cross-domains

  • Jerome

    Jerome - 2009-02-12

    I have a frameset that embeds a page from a different sub-domain, containing some formula that should be processed by jsMath. See <>.

    On IE7, the formatting fails with a "Permission denied" error, on line 143 (when debugger is enabled)
    This corresponds to the following test:

    >>>    if (jsMath.window.location.protocol.match(this.noCookiePattern)) {
             cookies = this.localGetCookie();
             this.isLocalCookie = 1;

    When the subframe is displayed in its own page, the rendering is done without problem.
    It is apparently not possible for my subframe to access the main window location/protocol.
    I tried to set 'allowGlobal' to 0, but this does not help. Has anyone experienced a similar problem?
    Is it hopeless trying to use jsMath in this configuration, for this browser?

    • Davide P. Cervone

      I have tracked down he problem.  It turns out that jsMath's attempt to synchronize its document's domain for use with the frameset used by the GoGlobal button is causing IE to get confused about its security settings.  (All other browsers seem to be able to handle this properly.)

      The solution in your case is to disable that test (since you aren't using the global settings anyway; BTW, you might want to use the noGlobal plugin to turn that option off to prevent users from messing up your frameset with jsMath's own). 

      To disable the domain check in IE, add

      __ if (document.all && !window.opera) {
      ____ jsMath.Global = {Domain: function () {}};
      __ }

      to your easy/load.js file just above the "Do not change below this" comment near the bottom of the file.  Note that I've used underscores in the example above so that this forum will show the indenting; you will need to change those to spaces when you paste the code into easy/load.js.

      I will fix the problem in the next release of jsMath, but this should fix your issue for now.


      • Jerome

        Jerome - 2009-02-18

        Thank for your help. Unfortunately overriding the 'Domain' function did not work.

        The problem really seems to come from the fact that the sub-frame cannot access the window.location attribute (or maybe the subcomponents 'window.location.port' and 'window.location.protocol'?). I thought at some point that it was similar to this rather famous IE7 security restriction regarding iframes (Eg: <>), but even setting my IE7 to the lowest security settings did not help.

        What I ended up doing is to override the functions that access this forbidden window.location attribute:

        if (document.all && !window.opera) {
        ____jsMath.Controls = {GetCookie: function () {
        _________this.cookie = {};
        ____jsMath.Setup = {Source: function () {
        _________jsMath.root = "";
        _________jsMath.Img.root = jsMath.root + "fonts/";
        _________jsMath.blank = jsMath.root + "blank.gif";

        I know it is quite ugly and possibly bad for future upgrades of my jsMath installation, but it worked. Do you see a better way to solve this problem?

        • Davide P. Cervone

          I understand that IE is failing on the access to window.location, but my experiments suggest that the changes to the document.domain done in jsMath.Global.Domain are what are triggering the failure to access window.location.  It is not the code that is using window.location that is at fault (there is no reason IE should not be able to use the current window's location object).  In my experiments, it seemed that the domain changes were confusing IE's security system, so disabling the domain changes allowed the window.location access to succeed as normal.

          I'm wondering if you cleared the browser cache when you made the changes I suggested?  Perhaps you got a cached version rather than the updated version, and so didn't get the actual changed code?

          What you have done should work, but it does disable some features (like using the jsMath options panel to change any settings).

          Here's something else to try as an experiment.  Replace your code with the line

          ___ jsMath.isCHMmode = 1;

          and see if that works.



Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks