Warning messages upon opening some dialogs in IE under HTTPS

[martinkou]

Reproduction procedure:

1. Open sample01.html in IE6 or 7 under HTTPS and domain relaxation mode.
2. Open the image dialog, or the flash dialog, or the image button dialog.
3. Warning message about unsafe contents.

[w.olchawa]

Just moved the keywords to "Keywords Filed"

[martinkou]

Thanks ;)

Sometimes I'm just too sleepy filling those fields.

[martinkou]

Domain relaxation is not needed, the bug can be reproduced without domain relaxation. Simply HTTPS would trigger the bug.

[fredck]

I'm not able to reproduce this problem with the Flash dialog (with or without domain relaxation). It seems related to the Image dialog exclusively, due to the <img src="javascript:void(0)">

Applying the proposed fix to the image removes the warning, but it's a regression to a previous problem. The browser makes a request for the image to "editor/dialog/fck_image/".

I have the impression that removing the "src" attribute completely from the source would fix it properly, but it has to be well tested across all browsers to be sure nothing get broken.

[martinkou]

The warning in the Flash dialog appears in IE6 only (even for the IE6 in Multiple IE), it doesn't appear in IE7.

[martinkou]

Confirmed deleting the "src" attribute eliminates the security warning on both IE6 and IE7.

The fix for the iframe in the Flash dialog is still needed though, as the original iframe code (even without a src attribute) triggers security warning in IE6.

I'm proposing a new patch with the fixed <img> tag.

[martinkou]

Fixed with [1689].

Click here for more info about our SVN system.