Check for same origin before using window.top
#239 aberto em 27 de dez. de 2017
Métricas do repositório
- Stars
- (955 stars)
- Métricas de merge de PR
- (Nenhuma PRs mesclada em 30d)
Description
With https://github.com/claviska/jquery-minicolors/pull/207 top.document should be used to attach the event handlers. When the top window is from a different origin (e.g. the site is embedded in an iframe from a different origin) then access to window.top (and therefore top.document) is prohibited by the browser. This leads to the following exception:
Therefore access to window.top should be avoided or at least there should be a check if its safe to acces it (try catch?).
edit: I don't know why, but there is a commit that reverts the changes from https://github.com/claviska/jquery-minicolors/pull/207 see https://github.com/claviska/jquery-minicolors/commit/106c1988adc488a8b0aba4adb2a61e90de2abaa0 But its not already releaset so that the current released version still contains the access of window.top