Opened 15 years ago

Closed 12 months ago

#10327 closed Cleanup/optimization (wontfix)

Pass document.domain to popup windows in admin

Reported by: Joost Cassee Owned by: nobody
Component: contrib.admin Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: yes
Easy pickings: no UI/UX: no

Description

Some applications require Javascript collaboration between views and scripts from the static media location. When these are served from different domains collaboration fails because of the same origin policy implemented in browsers. Scripts can still work together if they are served from subdomains with a common parent (for example, www.example.com and media.example.com) by setting the document.domain variable to that common parent (in the example, example.com).

Unfortunately, the document.domain variable is not automatically passed to newly opened windows. The attached patch passes the variable to popup windows in the admin interface. Currently it is always passed, but may be nicer to do so only if it is different from the real server name. There are also currently no tests; I'm unsure how to test this functionality.

The patch was tested with the TinyMCE editor, which uses the above trick for its own popup windows. The patch allows, for example, the raw_id_fields functionality to work again for pages with TinyMCE editors (when static files are served from a different domain).

Attachments (2)

10327-r9845.diff (2.8 KB ) - added by Joost Cassee 15 years ago.
10327-r9969.diff (3.1 KB ) - added by Joost Cassee 15 years ago.

Download all attachments as: .zip

Change History (14)

by Joost Cassee, 15 years ago

Attachment: 10327-r9845.diff added

comment:1 by Jacob, 15 years ago

milestone: 1.1
Patch needs improvement: set
Triage Stage: UnreviewedAccepted

comment:2 by Joost Cassee, 15 years ago

The new patch only appends the jsdom query parameter if the Javascript domain differs from the location domain. Additionally, it is given its own variable in the template context (like is_popup). I hope the patch is now good enough to be applied, otherwise please indicate how to improve it.

by Joost Cassee, 15 years ago

Attachment: 10327-r9969.diff added

comment:3 by Joost Cassee, 15 years ago

Has patch: set
Patch needs improvement: unset

Setting has_patch and removing needs_better_patch to invite patch review.

comment:4 by Jacob, 15 years ago

milestone: 1.11.2

Pushing to 1.2 since this is an uncommon case. For now you can use a custom template along with the custom widget to do this same thing if you need.

comment:5 by s.federici, 15 years ago

Patch needs improvement: set

Patches proposed breaks the Admin ForingnKey javascript (/media/js/admin/RelatedObjectLookups.js)

I have changed my prospectives, all static resources affected by this bug, for the "Same origin policy", will be served by central site.

in reply to:  5 comment:6 by Joost Cassee, 15 years ago

Replying to s.federici:

Patches proposed breaks the Admin ForingnKey javascript (/media/js/admin/RelatedObjectLookups.js)

Funny, the patch was supposed to fix the admin ForeignKey problem. I'll look into it, thanks for the heads-up.

I have changed my prospectives, all static resources affected by this bug, for the "Same origin policy", will be served by central site.

Sorry, I don't really understand this sentence.

comment:7 by James Bennett, 14 years ago

milestone: 1.2

1.2 is feature-frozen, moving this feature request off the milestone.

comment:8 by Chris Beaven, 13 years ago

Severity: Normal
Type: Bug

comment:9 by Aymeric Augustin, 12 years ago

UI/UX: unset

Change UI/UX from NULL to False.

comment:10 by Aymeric Augustin, 12 years ago

Easy pickings: unset

Change Easy pickings from NULL to False.

comment:11 by Gert Van Gool, 11 years ago

This could be solved now with the changes from #19773.

comment:12 by Mariusz Felisiak, 12 months ago

Resolution: wontfix
Status: newclosed
Type: BugCleanup/optimization

The document.domain setter is deprecated and dangerous.

Note: See TracTickets for help on using tickets.
Back to Top