Ticket #123: 123.patch

editor/_source/classes/fckeditingarea.js

@@ -57 +57 @@
 
         if ( this.Mode == FCK_EDITMODE_WYSIWYG )
         {
-                // Create the editing area IFRAME.
-                var oIFrame = this.IFrame = oTargetDocument.createElement( 'iframe' ) ;
-                
-                // Firefox will render the tables inside the body in Quirks mode if the 
-                // source of the iframe is set to javascript. see #515
-                if ( !FCKBrowserInfo.IsGecko )
-                        oIFrame.src = 'javascript:void(0)' ;
-                
-                oIFrame.frameBorder = 0 ;
-                oIFrame.width = oIFrame.height = '100%' ;
+                // For FF, document.domain must be set only when different, otherwhise
+                // we'll strangely have "Permission denied" issues.
+                if ( FCK_IS_CUSTOM_DOMAIN )
+                        html = '<script>document.domain="' + FCK_RUNTIME_DOMAIN + '";</script>' + html ;
 
-                // Append the new IFRAME to the target.
-                eTargetElement.appendChild( oIFrame ) ;
-
                 // IE has a bug with the <base> tag... it must have a </base> closer,
                 // otherwise the all successive tags will be set as children nodes of the <base>.
                 if ( FCKBrowserInfo.IsIE )
@@ -105 +96 @@
                                 this._BodyHTML = html ;                 // Invalid HTML input.
                 }
 
+                // Create the editing area IFRAME.
+                var oIFrame = this.IFrame = oTargetDocument.createElement( 'iframe' ) ;
+
+                oIFrame.frameBorder = 0 ;
+                oIFrame.width = oIFrame.height = '100%' ;
+
+                if ( FCK_IS_CUSTOM_DOMAIN && FCKBrowserInfo.IsIE )
+                {
+                        window._FCKHtmlToLoad = html ;
+                        oIFrame.src = 'javascript:void( (function(){' +
+                                'document.open() ;' +
+                                'document.domain="' + document.domain + '" ;' +
+                                'document.write( window.parent._FCKHtmlToLoad );' +
+                                'document.close() ;' +
+                                'window.parent._FCKHtmlToLoad = null ;' +
+                                '})() )' ;
+                }
+                else if ( !FCKBrowserInfo.IsGecko )
+                {
+                        // Firefox will render the tables inside the body in Quirks mode if the
+                        // source of the iframe is set to javascript. see #515
+                        oIFrame.src = 'javascript:void(0)' ;
+                }
+
+                // Append the new IFRAME to the target. For IE, it must be done after
+                // setting the "src", to avoid the "secure/unsecure" message under HTTPS.
+                eTargetElement.appendChild( oIFrame ) ;
+
                 // Get the window and document objects used to interact with the newly created IFRAME.
                 this.Window = oIFrame.contentWindow ;
 
@@ -112 +131 @@
                 // TODO: This error handler is not being fired.
                 // this.Window.onerror = function() { alert( 'Error!' ) ; return true ; }
 
-                var oDoc = this.Document = this.Window.document ;
+                if ( !FCK_IS_CUSTOM_DOMAIN || !FCKBrowserInfo.IsIE )
+                {
+                        var oDoc = this.Window.document ;
 
-                oDoc.open() ;
-                oDoc.write( html ) ;
-                oDoc.close() ;
+                        oDoc.open() ;
+                        oDoc.write( html ) ;
+                        oDoc.close() ;
+                }
 
                 // Firefox 1.0.x is buggy... ohh yes... so let's do it two times and it
                 // will magically work.
@@ -126 +148 @@
                         return ;
                 }
 
-                this.Window._FCKEditingArea = this ;
+                if ( oIFrame.readyState && oIFrame.readyState != 'completed' )
+                {
+                        var editArea = this ;
+                        ( oIFrame.onreadystatechange = function()
+                        {
+                                if ( oIFrame.readyState == 'complete' )
+                                {
+                                        oIFrame.onreadystatechange = null ;
+                                        editArea.Window._FCKEditingArea = editArea ;
+                                        FCKEditingArea_CompleteStart.call( editArea.Window ) ;
+                                }
+                        // It happened that IE changed the state to "complete" after the
+                        // "if" and before the "onreadystatechange" assignement, making we
+                        // lost the event call, so we do a manual call just to be sure.
+                        } )() ; 
+                }
+                else
+                {
+                        this.Window._FCKEditingArea = this ;
 
-                // FF 1.0.x is buggy... we must wait a lot to enable editing because
-                // sometimes the content simply disappears, for example when pasting
-                // "bla1!<img src='some_url'>!bla2" in the source and then switching
-                // back to design.
-                if ( FCKBrowserInfo.IsGecko10 )
-                        this.Window.setTimeout( FCKEditingArea_CompleteStart, 500 ) ;
-                else
-                        FCKEditingArea_CompleteStart.call( this.Window ) ;
+                        // FF 1.0.x is buggy... we must wait a lot to enable editing because
+                        // sometimes the content simply disappears, for example when pasting
+                        // "bla1!<img src='some_url'>!bla2" in the source and then switching
+                        // back to design.
+                        if ( FCKBrowserInfo.IsGecko10 )
+                                this.Window.setTimeout( FCKEditingArea_CompleteStart, 500 ) ;
+                        else
+                                FCKEditingArea_CompleteStart.call( this.Window ) ;
+                }
         }
         else
         {
                 var eTextarea = this.Textarea = oTargetDocument.createElement( 'textarea' ) ;
                 eTextarea.className = 'SourceField' ;
                 eTextarea.dir = 'ltr' ;
-                FCKDomTools.SetElementStyles( eTextarea, 
-                        { 
-                                width   : '100%', 
-                                height  : '100%', 
-                                border  : 'none', 
+                FCKDomTools.SetElementStyles( eTextarea,
+                        {
+                                width   : '100%',
+                                height  : '100%',
+                                border  : 'none',
                                 resize  : 'none',
                                 outline : 'none'
                         } ) ;
@@ -170 +211 @@
         }
 
         var oEditorArea = this._FCKEditingArea ;
-        
+
+        // Save this reference to be re-used later.
+        oEditorArea.Document = oEditorArea.Window.document ;
+
         oEditorArea.MakeEditable() ;
 
         // Fire the "OnLoad" event.
@@ -232 +276 @@
                         // Disable the standard table editing features of Firefox.
                         oDoc.execCommand( 'enableInlineTableEditing', false, !FCKConfig.DisableFFTableHandles ) ;
                 }
-                catch (e) 
+                catch (e)
                 {
                         // In Firefox if the iframe is initially hidden it can't be set to designMode and it raises an exception
                         // So we set up a DOM Mutation event Listener on the HTML, as it will raise several events when the document is  visible again
@@ -247 +291 @@
 function FCKEditingArea_Document_AttributeNodeModified( evt )
 {
         var editingArea = evt.currentTarget.contentWindow._FCKEditingArea ;
-        
+
         // We want to run our function after the events no longer fire, so we can know that it's a stable situation
         if ( editingArea._timer )
                 window.clearTimeout( editingArea._timer ) ;
 
-        editingArea._timer = FCKTools.SetTimeout( FCKEditingArea_MakeEditableByMutation, 1000, editingArea ) ;  
+        editingArea._timer = FCKTools.SetTimeout( FCKEditingArea_MakeEditableByMutation, 1000, editingArea ) ;
 }
 
 // This function ideally should be called after the document is visible, it does clean up of the
@@ -313 +357 @@
         // Only apply the fix when in a block and the block is empty.
         var parentNode = range.parentElement() ;
 
-        if ( ! ( parentNode.childNodes.length == 0 && ( 
-                                        FCKListsLib.BlockElements[parentNode.nodeName.toLowerCase()] || 
+        if ( ! ( parentNode.childNodes.length == 0 && (
+                                        FCKListsLib.BlockElements[parentNode.nodeName.toLowerCase()] ||
                                         FCKListsLib.NonEmptyBlockElements[parentNode.nodeName.toLowerCase()] ) ) )
                 return ;
 

editor/_source/classes/fckpanel.js

@@ -34 +34 @@
 
         if ( FCKBrowserInfo.IsIE )
         {
+                // This is a trick to IE6 (not IE7). The original domain must be set
+                // before creating the popup, so we are able to take a refence to the
+                // document inside of it, and the set the proper domain for it. (#123)
+                if ( FCK_IS_CUSTOM_DOMAIN )
+                        document.domain = FCK_ORIGINAL_DOMAIN ;
+                
                 // Create the Popup that will hold the panel.
                 this._Popup     = this._Window.createPopup() ;
                 oDocument = this.Document = this._Popup.document ;
 
+                // Set the proper domain inside the popup.
+                if ( FCK_IS_CUSTOM_DOMAIN )
+                        document.domain = oDocument.domain = FCK_RUNTIME_DOMAIN ;
+
                 FCK.IECleanup.AddItem( this, FCKPanel_Cleanup ) ;
         }
         else

editor/_source/classes/fckxml_gecko.js

@@ -26 +26 @@
         LoadUrl : function( urlToCall )
         {
                 this.Error = false ;
-                var oFCKXml = this ;
 
+                var oXml ;
                 var oXmlHttp = FCKTools.CreateXmlObject( 'XmlHttp' ) ;
-                oXmlHttp.open( "GET", urlToCall, false ) ;
+                oXmlHttp.open( 'GET', urlToCall, false ) ;
                 oXmlHttp.send( null ) ;
 
                 if ( oXmlHttp.status == 200 || oXmlHttp.status == 304 )
-                        this.DOMDocument = oXmlHttp.responseXML ;
+                        oXml = oXmlHttp.responseXML ;
                 else if ( oXmlHttp.status == 0 && oXmlHttp.readyState == 4 )
-                        this.DOMDocument = oXmlHttp.responseXML ;
+                        oXml = oXmlHttp.responseXML ;
                 else
-                        this.DOMDocument = null ;
+                        oXml = null ;
 
-                if ( this.DOMDocument == null || this.DOMDocument.firstChild == null )
+                if ( oXml )
                 {
+                        // Try to access something on it.
+                        try
+                        {
+                                var test = oXml.firstChild ;
+                        }
+                        catch (e)
+                        {
+                                // If document.domain has been changed (#123), we'll have a security
+                                // error at this point. The workaround here is parsing the responseText:
+                                // http://alexander.kirk.at/2006/07/27/firefox-15-xmlhttprequest-reqresponsexml-and-documentdomain/
+                                oXml = (new DOMParser()).parseFromString( oXmlHttp.responseText, 'text/xml' ) ;
+                        }
+                }
+
+                if ( !oXml || !oXml.firstChild )
+                {
                         this.Error = true ;
-                        if (window.confirm( 'Error loading "' + urlToCall + '"\r\nDo you want to see more info?' ) )
-                                alert( 'URL requested: "' + urlToCall + '"\r\n' +
-                                                        'Server response:\r\nStatus: ' + oXmlHttp.status + '\r\n' +
-                                                        'Response text:\r\n' + oXmlHttp.responseText ) ;
-
+                        if ( window.confirm( 'Error loading "' + urlToCall + '" (HTTP Status: ' + oXmlHttp.status + ').\r\nDo you want to see the server response dump?' ) )
+                                alert( oXmlHttp.responseText ) ;
                 }
+                
+                this.DOMDocument = oXml ;
         },
 
         SelectNodes : function( xpath, contextNode )

editor/_source/internals/fck.js

@@ -507 +507 @@
 
         Preview : function()
         {
-                var iWidth      = FCKConfig.ScreenWidth * 0.8 ;
-                var iHeight     = FCKConfig.ScreenHeight * 0.7 ;
-                var iLeft       = ( FCKConfig.ScreenWidth - iWidth ) / 2 ;
-                var oWindow = window.open( '', null, 'toolbar=yes,location=no,status=yes,menubar=yes,scrollbars=yes,resizable=yes,width=' + iWidth + ',height=' + iHeight + ',left=' + iLeft ) ;
-
                 var sHTML ;
 
                 if ( FCKConfig.FullPage )
@@ -535 +530 @@
                                 '</body></html>' ;
                 }
 
-                oWindow.document.write( sHTML );
-                oWindow.document.close();
+                var iWidth      = FCKConfig.ScreenWidth * 0.8 ;
+                var iHeight     = FCKConfig.ScreenHeight * 0.7 ;
+                var iLeft       = ( FCKConfig.ScreenWidth - iWidth ) / 2 ;
+                
+                var sOpenUrl = '' ;
+                if ( FCK_IS_CUSTOM_DOMAIN && FCKBrowserInfo.IsIE) 
+                {
+                        window._FCKHtmlToLoad = sHTML ;
+                        sOpenUrl = 'javascript:void( (function(){' +
+                                'document.open() ;' +
+                                'document.domain="' + document.domain + '" ;' +
+                                'document.write( window.opener._FCKHtmlToLoad );' +
+                                'document.close() ;' +
+                                'window.opener._FCKHtmlToLoad = null ;' +
+                                '})() )' ;
+                }
+                
+                var oWindow = window.open( sOpenUrl, null, 'toolbar=yes,location=no,status=yes,menubar=yes,scrollbars=yes,resizable=yes,width=' + iWidth + ',height=' + iHeight + ',left=' + iLeft ) ;
+
+                if ( !FCK_IS_CUSTOM_DOMAIN || !FCKBrowserInfo.IsIE) 
+                {
+                        oWindow.document.write( sHTML );
+                        oWindow.document.close();
+                }
+
         },
 
         SwitchEditMode : function( noUndo )

editor/_source/internals/fcktools_gecko.js

@@ -111 +111 @@
         {
                 case 'XmlHttp' :
                         return new XMLHttpRequest() ;
+
                 case 'DOMDocument' :
-                        return document.implementation.createDocument( '', '', null ) ;
+                        // Originaly, we were had the following here:
+                        // return document.implementation.createDocument( '', '', null ) ;
+                        //
+                        // But, when manipulating document.domain (#123), we had
+                        // "Permission denied" errors when trying to call methods inside
+                        // the returned object. To avoid it, we have to change to the
+                        // following, by implementing a "custom" DOM document object, which
+                        // includes the methods that are useful for us.
+
+                        var domDoc = document.createDocumentFragment() ;
+
+                        domDoc.createElement = function( name )
+                        {
+                                return document.createElement( name ) ;
+                        }
+
+                        domDoc.createTextNode = function( text )
+                        {
+                                return document.createTextNode( text ) ;
+                        }
+
+                        domDoc.createAttribute = function( attName )
+                        {
+                                return document.createAttribute( attName ) ;
+                        }
+
+                        domDoc.createComment = function( text )
+                        {
+                                return document.createComment( text ) ;
+                        }
+
+                        return domDoc ;
         }
         return null ;
 }
@@ -224 +256 @@
                         break ;
 
                 /*
-                FCKDebug.Output( el.tagName + ":" + "offset=" + el.offsetLeft + "," + el.offsetTop + "  " 
+                FCKDebug.Output( el.tagName + ":" + "offset=" + el.offsetLeft + "," + el.offsetTop + "  "
                                 + "scroll=" + el.scrollLeft + "," + el.scrollTop ) ;
                 */
 

editor/_source/internals/fckxhtml.js

@@ -43 +43 @@
 
         // Create the XML DOMDocument object.
         this.XML = FCKTools.CreateXmlObject( 'DOMDocument' ) ;
-
+        
         // Add a root element that holds all child nodes.
         this.MainNode = this.XML.appendChild( this.XML.createElement( 'xhtml' ) ) ;
 

editor/_source/internals/fckxhtml_gecko.js

@@ -24 +24 @@
 
 FCKXHtml._GetMainXmlString = function()
 {
-        // Create the XMLSerializer.
-        var oSerializer = new XMLSerializer() ;
-
-        // Return the serialized XML as a string.
-        return oSerializer.serializeToString( this.MainNode ) ;
+        return '<xhtml>' + this.MainNode.innerHTML + '</xhtml>' ;
 }
 
 FCKXHtml._AppendAttributes = function( xmlNode, htmlNode, node )

editor/dialog/common/fck_dialog_common.js

@@ -19 +19 @@
  * == END LICENSE ==
  *
  * Useful functions used by almost all dialog window pages.
+ * Dialogs should link to this file as the very first script on the page.
  */
 
+// Automatically detect the correct document.domain (#123).
+(function()
+{
+        var d = document.domain ;
+
+        while ( true )
+        {
+                // Test if we can access a parent property.
+                try
+                {
+                        var test = window.parent.document.domain ;
+                        break ;
+                }
+                catch( e ) {}
+                
+                // Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
+                d = d.replace( /.*?(?:\.|$)/, '' ) ;
+
+                if ( d.length == 0 )
+                        break ;         // It was not able to detect the domain.
+                
+                try
+                {
+                        document.domain = d ;
+                }
+                catch (e) 
+                {
+                        break ;
+                }
+        }
+})() ; 
+
 // Gets a element by its Id. Used for shorter coding.
 function GetE( elementId )
 {

editor/dialog/fck_colorselector.html

@@ -34 +34 @@
                         #btnClear               { width: 75px ; height: 22px ; margin-bottom: 6px ; }
                         .ColorCell              { height: 15px ; width: 15px ; }
                 </style>
+                <script src="common/fck_dialog_common.js" type="text/javascript"></script>
                 <script type="text/javascript">
 
 var oEditor = window.parent.InnerDialogLoaded() ;
@@ -135 +136 @@
 
 function Ok()
 {
-        if ( typeof(window.parent.dialogArguments.CustomValue) == 'function' )
-                window.parent.dialogArguments.CustomValue( document.getElementById('selcolor').value ) ;
+        if ( typeof(window.parent.args.CustomValue) == 'function' )
+                window.parent.args.CustomValue( document.getElementById('selcolor').value ) ;
 
         return true ;
 }

editor/dialog/fck_find.html

@@ -1 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
 <!--
  * FCKeditor - The text editor for Internet - http://www.fckeditor.net
  * Copyright (C) 2003-2007 Frederico Caldeira Knabben
@@ -26 +26 @@
         <title></title>
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
         <meta content="noindex, nofollow" name="robots" />
+        <script src="common/fck_dialog_common.js" type="text/javascript"></script>
         <script type="text/javascript">
 
 var oEditor = window.parent.InnerDialogLoaded() ;

editor/dialog/fck_flash/fck_flash_preview.html

@@ -27 +27 @@
                 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
                 <meta name="robots" content="noindex, nofollow">
                 <link href="../common/fck_dialog_common.css" rel="stylesheet" type="text/css" />
+                <script src="../common/fck_dialog_common.js" type="text/javascript"></script>
                 <script language="javascript">
 
 // Sets the Skin CSS

editor/dialog/fck_image/fck_image_preview.html

@@ -29 +29 @@
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
         <meta name="robots" content="noindex, nofollow" />
         <link href="../common/fck_dialog_common.css" rel="stylesheet" type="text/css" />
+        <script src="../common/fck_dialog_common.js" type="text/javascript"></script>
         <script type="text/javascript">
 
 // Sets the Skin CSS
@@ -47 +48 @@
         </script>
 </head>
 <body style="color: #000000; background-color: #ffffff">
-        <a id="lnkPreview" onclick="return false;" style="cursor: default">
-                <img id="imgPreview" onload="window.parent.UpdateOriginal();" style="display: none" /></a>Lorem
-        ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas feugiat consequat diam.
-        Maecenas metus. Vivamus diam purus, cursus a, commodo non, facilisis vitae, nulla.
-        Aenean dictum lacinia tortor. Nunc iaculis, nibh non iaculis aliquam, orci felis
-        euismod neque, sed ornare massa mauris sed velit. Nulla pretium mi et risus. Fusce
-        mi pede, tempor id, cursus ac, ullamcorper nec, enim. Sed tortor. Curabitur molestie.
-        Duis velit augue, condimentum at, ultrices a, luctus ut, orci. Donec pellentesque
-        egestas eros. Integer cursus, augue in cursus faucibus, eros pede bibendum sem,
-        in tempus tellus justo quis ligula. Etiam eget tortor. Vestibulum rutrum, est ut
-        placerat elementum, lectus nisl aliquam velit, tempor aliquam eros nunc nonummy
-        metus. In eros metus, gravida a, gravida sed, lobortis id, turpis. Ut ultrices,
-        ipsum at venenatis fringilla, sem nulla lacinia tellus, eget aliquet turpis mauris
-        non enim. Nam turpis. Suspendisse lacinia. Curabitur ac tortor ut ipsum egestas
-        elementum. Nunc imperdiet gravida mauris.
+        <div>
+                <a id="lnkPreview" onclick="return false;" style="cursor: default">
+                        <img id="imgPreview" src="javascript:void(0)" onload="window.parent.UpdateOriginal();"
+                                style="display: none" alt="" /></a>Lorem ipsum dolor sit amet, consectetuer adipiscing
+                elit. Maecenas feugiat consequat diam. Maecenas metus. Vivamus diam purus, cursus
+                a, commodo non, facilisis vitae, nulla. Aenean dictum lacinia tortor. Nunc iaculis,
+                nibh non iaculis aliquam, orci felis euismod neque, sed ornare massa mauris sed
+                velit. Nulla pretium mi et risus. Fusce mi pede, tempor id, cursus ac, ullamcorper
+                nec, enim. Sed tortor. Curabitur molestie. Duis velit augue, condimentum at, ultrices
+                a, luctus ut, orci. Donec pellentesque egestas eros. Integer cursus, augue in cursus
+                faucibus, eros pede bibendum sem, in tempus tellus justo quis ligula. Etiam eget
+                tortor. Vestibulum rutrum, est ut placerat elementum, lectus nisl aliquam velit,
+                tempor aliquam eros nunc nonummy metus. In eros metus, gravida a, gravida sed, lobortis
+                id, turpis. Ut ultrices, ipsum at venenatis fringilla, sem nulla lacinia tellus,
+                eget aliquet turpis mauris non enim. Nam turpis. Suspendisse lacinia. Curabitur
+                ac tortor ut ipsum egestas elementum. Nunc imperdiet gravida mauris.
+        </div>
 </body>
 </html>

editor/dialog/fck_paste.html

@@ -28 +28 @@
         <title></title>
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
         <meta name="robots" content="noindex, nofollow" />
-
+        <script src="common/fck_dialog_common.js" type="text/javascript"></script>
         <script type="text/javascript">
 var oEditor = window.parent.InnerDialogLoaded() ;
 var FCK = oEditor.FCK;
 var FCKTools    = oEditor.FCKTools ;
 var FCKConfig   = oEditor.FCKConfig ;
+var FCKBrowserInfo = oEditor.FCKBrowserInfo ;
 
 window.onload = function ()
 {
         // First of all, translate the dialog box texts
         oEditor.FCKLanguageManager.TranslatePage(document) ;
 
-        var sPastingType = window.parent.dialogArguments.CustomValue ;
+        var sPastingType = window.parent.args.CustomValue ;
 
         if ( sPastingType == 'Word' || sPastingType == 'Security' )
         {
                 if ( sPastingType == 'Security' )
                         document.getElementById( 'xSecurityMsg' ).style.display = '' ;
 
-                var oFrame = document.getElementById('frmData') ;
-                oFrame.style.display = '' ;
-
-                // Avoid errors if the pasted content has any script that fails: #389
-                var oDoc = oFrame.contentWindow.document ;
-                oDoc.open() ;
-                oDoc.write('<html><head><script>window.onerror = function() { return true ; };<\/script><\/head><body><\/body><\/html>') ;
-                oDoc.close() ;
+                // For document.domain compatibility (#123) we must do all the magic in
+                // the URL for IE.
+                var sFrameUrl = !oEditor.FCK_IS_CUSTOM_DOMAIN || !FCKBrowserInfo.IsIE ? 
+                        'javascript:void(0)' :
+                        'javascript:void( (function(){' +
+                                'document.open() ;' +
+                                'document.domain=\'' + document.domain + '\' ;' +
+                                'document.write(\'<html><head><script>window.onerror = function() { return true ; };<\/script><\/head><body><\/body><\/html>\') ;' +
+                                'document.close() ;' +
+                                'document.body.contentEditable = true ;' +
+                                'window.focus() ;' +
+                                '})() )' ;
+                        
+                var eFrameSpace = document.getElementById( 'xFrameSpace' ) ;
+                eFrameSpace.innerHTML = '<iframe id="frmData" src="' + sFrameUrl + '" ' +
+                                        'height="98%" width="99%" frameborder="0" style="border: #000000 1px; background-color: #ffffff"></iframe>' ;
                 
-                if ( oFrame.contentDocument )
-                        oFrame.contentDocument.designMode = 'on' ;
-                else
-                        oFrame.contentWindow.document.body.contentEditable = true ;
+                var oFrame = eFrameSpace.firstChild ;
 
-                // Set the focus on the pasting area
-                oFrame.contentWindow.focus();
+                if ( !oEditor.FCK_IS_CUSTOM_DOMAIN || !FCKBrowserInfo.IsIE )
+                {
+                        // Avoid errors if the pasted content has any script that fails: #389
+                        var oDoc = oFrame.contentWindow.document ;
+                        oDoc.open() ;
+                        oDoc.write('<html><head><script>window.onerror = function() { return true ; };<\/script><\/head><body><\/body><\/html>') ;
+                        oDoc.close() ;
+
+                        if ( FCKBrowserInfo.IsIE )
+                                oDoc.body.contentEditable = true ;
+                        else
+                                oDoc.designMode = 'on' ;
+
+                        oFrame.contentWindow.focus();
+                }
         }
         else
         {
@@ -83 +102 @@
 
         var sHtml ;
 
-        var sPastingType = window.parent.dialogArguments.CustomValue ;
+        var sPastingType = window.parent.args.CustomValue ;
 
         if ( sPastingType == 'Word' || sPastingType == 'Security' )
         {
@@ -306 +325 @@
                         </td>
                 </tr>
                 <tr>
-                        <td valign="top" height="100%" style="border-right: #000000 1px solid; border-top: #000000 1px solid;
-                                border-left: #000000 1px solid; border-bottom: #000000 1px solid">
+                        <td id="xFrameSpace" valign="top" height="100%" style="border: #000000 1px solid">
                                 <textarea id="txtData" cols="80" rows="5" style="border: #000000 1px; display: none;
                                         width: 99%; height: 98%"></textarea>
-                                <iframe id="frmData" src="javascript:void(0)" height="98%" width="99%" frameborder="0"
-                                        style="border-right: #000000 1px; border-top: #000000 1px; display: none; border-left: #000000 1px;
-                                        border-bottom: #000000 1px; background-color: #ffffff"></iframe>
                         </td>
                 </tr>
                 <tr id="oWordCommands">

editor/dialog/fck_smiley.html

@@ -33 +33 @@
                         cursor: hand;
                 }
         </style>
+        <script src="common/fck_dialog_common.js" type="text/javascript"></script>
         <script type="text/javascript">
 
 var oEditor = window.parent.InnerDialogLoaded() ;

editor/dialog/fck_specialchar.html

@@ -33 +33 @@
                                 }
                                 .Sample { font-size: 24px; }
                 </style>
+                <script src="common/fck_dialog_common.js" type="text/javascript"></script>
                 <script type="text/javascript">
 
 var oEditor = window.parent.InnerDialogLoaded() ;

editor/dialog/fck_spellerpages.html

@@ -26 +26 @@
                 <title>Spell Check</title>
                 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
                 <meta content="noindex, nofollow" name="robots">
+                <script src="common/fck_dialog_common.js" type="text/javascript"></script>
                 <script src="fck_spellerpages/spellerpages/spellChecker.js"></script>
                 <script type="text/javascript">
 

editor/fckdialog.html

@@ -1 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
 <!--
  * FCKeditor - The text editor for Internet - http://www.fckeditor.net
  * Copyright (C) 2003-2007 Frederico Caldeira Knabben
@@ -27 +27 @@
                 <meta name="robots" content="noindex, nofollow" />
                 <script type="text/javascript">
 
+var args = window.dialogArguments ;
+
+// Automatically detect the correct document.domain (#123).
+(function()
+{
+        var d = document.domain ;
+
+        while ( true )
+        {
+                // Test if we can access a parent property.
+                try
+                {
+                        var parentDomain = window.opener ? window.opener.document.domain : args.Editor.document.domain ;
+                        
+                        if ( document.domain != parentDomain )
+                                document.domain = parentDomain ;
+                        break ;
+                }
+                catch( e ) {}
+                
+                // Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
+                d = d.replace( /.*?(?:\.|$)/, '' ) ;
+
+                if ( d.length == 0 )
+                        break ;         // It was not able to detect the domain.
+                
+                document.domain = d ;
+        }
+})() ; 
+
 // On some Gecko browsers (probably over slow connections) the
 // "dialogArguments" are not set so we must get it from the opener window.
-if ( !window.dialogArguments )
-        window.dialogArguments = window.opener.FCKLastDialogInfo ;
+if ( !args )
+        args = window.dialogArguments = window.opener.FCKLastDialogInfo ;
 
 // Sets the Skin CSS
-document.write( '<link href="' + window.dialogArguments.Editor.FCKConfig.SkinPath + 'fck_dialog.css" type="text/css" rel="stylesheet">' ) ;
+document.write( '<link href="' + args.Editor.FCKConfig.SkinPath + 'fck_dialog.css" type="text/css" rel="stylesheet">' ) ;
 
 // Sets the language direction.
-window.document.dir = window.dialogArguments.Editor.FCKLang.Dir ;
+window.document.dir = args.Editor.FCKLang.Dir ;
 
-var sTitle = window.dialogArguments.Title ;
+var sTitle = args.Title ;
 document.write( '<title>' + sTitle + '<\/title>' ) ;
 
 function LoadInnerDialog()
@@ -47 +77 @@
                 window.onresize() ;
 
         // First of all, translate the dialog box contents.
-        window.dialogArguments.Editor.FCKLanguageManager.TranslatePage( document ) ;
+        args.Editor.FCKLanguageManager.TranslatePage( document ) ;
 
-        window.frames["frmMain"].document.location.href = window.dialogArguments.Page ;
+        document.getElementById( 'FrameCell' ).innerHTML = '<iframe id="frmMain" src="' + args.Page + '" name="frmMain" frameborder="0" height="100%" width="100%" scrolling="auto"></iframe>' ;
 }
 
 function InnerDialogLoaded()
@@ -57 +87 @@
         var oInnerDoc = document.getElementById('frmMain').contentWindow.document ;
 
         // Set the language direction.
-        oInnerDoc.dir = window.dialogArguments.Editor.FCKLang.Dir ;
+        oInnerDoc.dir = args.Editor.FCKLang.Dir ;
 
         // Sets the Skin CSS.
-        oInnerDoc.write( '<link href="' + window.dialogArguments.Editor.FCKConfig.SkinPath + 'fck_dialog.css" type="text/css" rel="stylesheet">' ) ;
+        oInnerDoc.write( '<link href="' + args.Editor.FCKConfig.SkinPath + 'fck_dialog.css" type="text/css" rel="stylesheet">' ) ;
 
         SetOnKeyDown( oInnerDoc ) ;
         DisableContextMenu( oInnerDoc ) ;
 
-        return window.dialogArguments.Editor ;
+        return args.Editor ;
 }
 
 function SetOkButton( showIt )
@@ -109 +139 @@
 
 // Kludge for #1316: Safari seems to have a bug with the time when RefreshSize() is executed - it thinks frmMain's innerHeight 
 // is 0 if we query the value too soon after the page is loaded in some circumstances.
-if ( window.dialogArguments.Editor.FCKBrowserInfo.IsSafari )
+if ( args.Editor.FCKBrowserInfo.IsSafari )
 {
         window.OriginalRefreshSize = RefreshSize ;
 
@@ -127 +157 @@
 
 function Cancel( dontFireChange )
 {
-        if ( !dontFireChange && !window.dialogArguments.Editor.FCK.EditMode )
+        if ( !dontFireChange && !args.Editor.FCK.EditMode )
         {
                 // All dialog windows, by default, will fire the "OnSelectionChange"
                 // event, no matter the Ok or Cancel button has been pressed.
-                window.dialogArguments.Editor.FCK.Events.FireEvent( 'OnSelectionChange' ) ;
+                args.Editor.FCK.Events.FireEvent( 'OnSelectionChange' ) ;
         }
         window.close() ;
 }
@@ -175 +205 @@
                 oDiv.className = 'PopupTabSelected' ;
                 eTabsRow.style.display = '' ;
 
-                if ( ! window.dialogArguments.Editor.FCKBrowserInfo.IsIE )
+                if ( ! args.Editor.FCKBrowserInfo.IsIE )
                         window.onresize() ;
         }
 
@@ -239 +269 @@
 
 function DisableContextMenu( targetDocument )
 {
-        if ( window.dialogArguments.Editor.FCKBrowserInfo.IsIE ) return ;
+        if ( args.Editor.FCKBrowserInfo.IsIE ) return ;
 
         // Disable Right-Click
         var oOnContextMenu = function( e )
@@ -252 +282 @@
 }
 DisableContextMenu( document ) ;
 
-if ( ! window.dialogArguments.Editor.FCKBrowserInfo.IsIE )
+if ( ! args.Editor.FCKBrowserInfo.IsIE )
 {
         window.onresize = function()
         {
@@ -270 +300 @@
         }
 }
 
-if ( window.dialogArguments.Editor.FCKBrowserInfo.IsIE )
+if ( args.Editor.FCKBrowserInfo.IsIE )
 {
         function Window_OnBeforeUnload()
         {
                 for ( var t in oTabs )
                         oTabs[t] = null ;
 
-                window.dialogArguments.Editor = null ;
+                args.Editor = null ;
         }
         window.attachEvent( "onbeforeunload", Window_OnBeforeUnload ) ;
 }
 
 function Window_OnClose()
 {
-        window.dialogArguments.Editor.FCKFocusManager.Unlock() ;
+        args.Editor.FCKFocusManager.Unlock() ;
 }
 
 if ( window.addEventListener )
@@ -313 +343 @@
                         </tr>
                         <tr>
                                 <td id="FrameCell" height="100%" valign="top">
-                                        <iframe id="frmMain" src="javascript:void(0)" name="frmMain" frameborder="0" height="100%" width="100%" scrolling="auto">
-                                        </iframe>
+                                        &nbsp;
                                 </td>
                         </tr>
                         <tr>

editor/fckeditor.html

@@ -31 +31 @@
         @Packager.RemoveLine -->
         <script type="text/javascript">
 
+// Save a reference to the default domain.
+var FCK_ORIGINAL_DOMAIN ;
+
+// Automatically detect the correct document.domain (#123).
+(function()
+{
+        var d = FCK_ORIGINAL_DOMAIN = document.domain ;
+
+        while ( true )
+        {
+                // Test if we can access a parent property.
+                try
+                {
+                        var test = window.parent.document.domain ;
+                        break ;
+                }
+                catch( e ) {}
+                
+                // Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
+                d = d.replace( /.*?(?:\.|$)/, '' ) ;
+
+                if ( d.length == 0 )
+                        break ;         // It was not able to detect the domain.
+                
+                try
+                {
+                        document.domain = d ;
+                }
+                catch (e)
+                {
+                        break ;
+                }
+        }
+})() ; 
+
+// Save a reference to the detected runtime domain.
+var FCK_RUNTIME_DOMAIN = document.domain ;
+
+var FCK_IS_CUSTOM_DOMAIN = ( FCK_ORIGINAL_DOMAIN != FCK_RUNTIME_DOMAIN ) ;
+
 // Instead of loading scripts and CSSs using inline tags, all scripts are
 // loaded by code. In this way we can guarantee the correct processing order,
 // otherwise external scripts and inline scripts could be executed in an