Ticket #1920 (closed Bug: fixed)

Opened 17 months ago

Last modified 16 months ago

Warning messages upon opening some dialogs in IE under HTTPS

Reported by: martinkou Owned by: martinkou
Priority: Normal Milestone: FCKeditor 2.6
Component: UI : Dialogs Version: SVN (FCKeditor)
Keywords: Confirmed IE Review+ Cc:

Description

Reproduction procedure:

  1. Open sample01.html in IE6 or 7 under HTTPS and domain relaxation mode.
  2. Open the image dialog, or the flash dialog, or the image button dialog.
  3. Warning message about unsafe contents.

Attachments

1920.patch (3.0 KB) - added by martinkou 16 months ago.
1920_2.patch (2.9 KB) - added by martinkou 16 months ago.

Change History

Changed 16 months ago by martinkou

  • component changed from General to UI : Dialogs

Changed 16 months ago by w.olchawa

  • cc Confirmed IE removed
  • keywords Confirmed IE added

Just moved the keywords to "Keywords Filed"

Changed 16 months ago by martinkou

  • owner set to martinkou
  • status changed from new to assigned

Thanks ;)

Sometimes I'm just too sleepy filling those fields.

Changed 16 months ago by martinkou

  • summary changed from Warning messages upon opening some dialogs in IE under HTTPS and domain relaxation mode to Warning messages upon opening some dialogs in IE under HTTPS

Domain relaxation is not needed, the bug can be reproduced without domain relaxation. Simply HTTPS would trigger the bug.

Changed 16 months ago by martinkou

Changed 16 months ago by martinkou

  • keywords Review? added

Changed 16 months ago by fredck

  • keywords Review- added; Review? removed

I'm not able to reproduce this problem with the Flash dialog (with or without domain relaxation). It seems related to the Image dialog exclusively, due to the <img src="javascript:void(0)">

Applying the proposed fix to the image removes the warning, but it's a regression to a previous problem. The browser makes a request for the image to "editor/dialog/fck_image/".

I have the impression that removing the "src" attribute completely from the source would fix it properly, but it has to be well tested across all browsers to be sure nothing get broken.

Changed 16 months ago by martinkou

The warning in the Flash dialog appears in IE6 only (even for the IE6 in Multiple IE), it doesn't appear in IE7.

Changed 16 months ago by martinkou

  • keywords Review? added; Review- removed

Confirmed deleting the "src" attribute eliminates the security warning on both IE6 and IE7.

The fix for the iframe in the Flash dialog is still needed though, as the original iframe code (even without a src attribute) triggers security warning in IE6.

I'm proposing a new patch with the fixed <img> tag.

Changed 16 months ago by martinkou

Changed 16 months ago by fredck

  • keywords Review+ added; Review? removed

Changed 16 months ago by martinkou

  • status changed from assigned to closed
  • resolution set to fixed

Fixed with [1689].

Click here for more info about our SVN system.

Note: See TracTickets for help on using tickets.