Changeset 8611 for tags/release-0.4.2/src/io/xip_client.html

Timestamp:

05/14/07 16:03:16 (20 months ago)

Author:

jburke

Message:

Fixes #3011.

Files:

• tags/release-0.4.2/src/io/xip_client.html (modified) (4 diffs)

tags/release-0.4.2/src/io/xip_client.html

@@ -6 +6 @@
         <title></title>
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>
-        <script type="text/javascript">
+        <!-- Security protection: uncomment the script tag to enable. -->
+        <!-- script type="text/javascript" -->
         // <!--
         /*
@@ -223 +224 @@
                 //Remove the query param for the IE7 recursive case.
                 xipServerUrl = fixServerUrl(config.server).replace(/(\?|\&)dojo\.fr\=1/, "");
+                
+                //Make sure we don't have a javascript: url, just for good measure.
+                if(xipServerUrl.split(":")[0].match(/javascript/i)){
+                        throw "Invalid server URL";
+                }
+
                 xipUseFrameRecursion = config["fr"];
                 
@@ -235 +242 @@
 
                 var clientUrl = window.location.href.split("#")[0];
-                document.getElementById("iframeHolder").innerHTML = '<iframe src="'
-                        + makeServerUrl("init", 'id=' + xipStateId + '&client=' + encodeURIComponent(clientUrl)
-                        + '&fr=' + xipUseFrameRecursion) + '" id="' + xipStateId + '_frame"></iframe>';
-                        
-                
+                var iframeNode = document.getElementsByTagName("iframe")[0];
+                iframeNode.id = xipStateId + "_frame";
+                iframeNode.src = makeServerUrl("init", 'id=' + xipStateId + '&client='
+                        + encodeURIComponent(clientUrl) + '&fr=' + xipUseFrameRecursion);
         }
 
@@ -257 +263 @@
         internally by dojo.io.XhrIframeProxy.</p>
         
-        <span id="iframeHolder"></span>
+        <iframe src="javascript:false"></iframe>
 </body>
 </html>