Using Frames and IFRAMES on a template

When using an Frame or an IFRAME on a MCMS2002 template you will experience a strange problem when switching to authoring mode: You will receive a Javascript ‘permission denied’ error.

This is a small issue in the coding of Console.js causing a Cross-Site-Scripting issue in framed sites. 

When switching between presentation and authoring mode Webauthor trys to change also the mode of all other frames.
 
This causes cross-site-scripting errors when the other frames do not belong to the same site.
This should also cause trouble in a framed site when the other frames contain content from other sites.
 
To solve this you have to add 8 lines of code to the Console.js file located at the following location:
\Program Files\Microsoft Content Management Server\Server\IIS_CMS\WebAuthor\Client\Console.js
 
Add the red lines to the code:

    function UpdateSiblingFramesInPublishedMode()
    {
        for (i=0; i < window.top.frames.length; i++)
        {
            if (window.top.frames[i] != window)
            {
                // refresh it with Published mode URL
                try
                {
                    window.top.frames[i].location.href =
                                 GetUrlModePublished( window.top.frames[i].location.href);
                }
                catch(e)
               
{}
            }
        }
    }

    ...

    function UpdateSiblingFramesInUnpublishedMode()
    {
        for (i=0; i < window.top.frames.length; i++)
        {
            if (window.top.frames[i] != window)
            {
                // refresh it with Unpublished mode URL
                try
                {
                    window.top.frames[i].location.href = 
                                 GetUrlModeUnpublished( window.top.frames[i].location.href);
                }
                catch(e)
                {}

            }
        }
    }

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.