Ticket #2390 (closed defect: fixed)

Opened 22 months ago

Last modified 17 months ago

ContentPane causes security error on IE7

Reported by: dojotrac@… Owned by: koranteng
Priority: normal Milestone: 0.9beta
Component: Dijit Version: 0.4.2
Severity: normal Keywords:
Cc:

Description

On IE7, the following code causes the infamous "This page contains both secure and nonsecure items" popup, as of the nightly build for Jan 31 2007. 

<html>
    <head>
        <title>Nonsecure Items?</title>
        <script type="text/javascript" src="../Script/dojo/dojo.js"></script>
        <script type="text/javascript">
        dojo.require("dojo.widget.ContentPane");
        </script>
    </head>
    <body>
        <div dojoType="ContentPane">asdf</div>
    </body>
</html>

Change History

Changed 21 months ago by pieter.vanh@…

Same Problem with Select Widget and IE7(https).

Changed 18 months ago by joose

This was a problem while back with IE6 and it was fixed doing something like src="javascript:false;" or similar. Well, this solution does not work with IE7. I found out that "In IE7 this could be fixed by src="https://about:blank", although this solution crashes IE6 :)" (quote from: http://gemal.dk/blog/2005/01/27/iframe_without_src_attribute_on_https_in_internet_explorer/)

This problem is also for Tooltip (#2681), Dialog, etc.. and is originating from src/html/iframe.js (just guessing, not tested). I suggest adding following: 

var html="";
if (dojo.render.html.ie70) {
 html="<iframe src='https://about:blank'"
                        + " style='position: absolute; left: 0px; top: 0px; width: 100%; height: 100%;"
                        + "z-index: -1; filter:Alpha(Opacity="0");' "
                        + ">";
} else {
 html="<iframe src='javascript:false'"
                        + " style='position: absolute; left: 0px; top: 0px; width: 100%; height: 100%;"
                        + "z-index: -1; filter:Alpha(Opacity="0");' "
                        + ">";
}

Changed 18 months ago by joose

  • version changed from 0.4.1 to 0.4.2

Forgot to mention that I just wrote that code, have not tested or anything.

Changed 18 months ago by bill

  • component changed from Widgets to Dijit
  • milestone set to 0.9

Changed 18 months ago by bill

  • owner changed from bill to koranteng

Changed 18 months ago by guest

Just tried the code suggested, but doesn't work.

The problem is that https://about:black isn't a valid address (try it in the location bar of IE7).

I suggest to make a static page as and point to it (as suggested here: http://dojotoolkit.org/pipermail/dojo-interest/2006-August/014101.html).

Changed 18 months ago by bill

"https://about:black" is a really strange URL. I assume that "black" is a typo for "blank", but even then, you should have either "https" or "about", not both. It should be either src="about:blank" or src="javascript:false"

Changed 17 months ago by bill

  • status changed from new to closed
  • resolution set to fixed
  • milestone changed from 0.9 to 0.9beta

Just tried 0.9; seems to be working (test_ContentPane.html doesn't return any errors)

Note: See TracTickets for help on using tickets.