Check for same origin before using window.top
#239 ouverte le 27 déc. 2017
Métriques du dépôt
- Stars
- (955 stars)
- Métriques de merge PR
- (Aucune PR mergée en 30 j)
Description
With https://github.com/claviska/jquery-minicolors/pull/207 top.document should be used to attach the event handlers. When the top window is from a different origin (e.g. the site is embedded in an iframe from a different origin) then access to window.top (and therefore top.document) is prohibited by the browser. This leads to the following exception:
Therefore access to window.top should be avoided or at least there should be a check if its safe to acces it (try catch?).
edit: I don't know why, but there is a commit that reverts the changes from https://github.com/claviska/jquery-minicolors/pull/207 see https://github.com/claviska/jquery-minicolors/commit/106c1988adc488a8b0aba4adb2a61e90de2abaa0 But its not already releaset so that the current released version still contains the access of window.top