Setting onunload across frames

khuffenb

01-07-2004, 05:30 AM

I am trying to set the onunload event handler of one frame from another. It only works with local files, and not with outside websites, even when I request enhanced privileges.

Example follows:

frameset.html:
<html>
<frameset cols="10%,*" frameborder="1">
<frame name="leftframe" src="left.html">
<frame name="rightframe" src="http://google.com">
</frameset>
</html>

left.html:
<html>
<script>
function unloading() {
alert("unloading!");
}
function set_onunload() {
try{
netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
parent.rightframe.onunload = unloading;
}
catch(e){
alert("Error : Can't set onunload!");
}
}
</script>

<a href="left.html" onClick="javascript:set_onunload()">Set onunload!</a>
</html>

If the external url in the righthand frame is replaced with a local file, the script works correctly, displaying the alert when the right hand frame unloads. With a nonlocal file though, the frame does not show an alert when unloading.

I'm using Mozilla 1.2.1.

Any guidance would be greatly appreciated.

glenngv

01-07-2004, 06:23 AM

If both frames are in the same domain (local or not), you don't have to ask browser privileges to set event handlers from one frame to the other. But it's not possible if they are from different domains. Granting it's possible, it would probably be a vulnerability exploit. Imagine if you could do that in any external sites, it would create havoc. You don't want your site to be controlled by other sites, do you?

khuffenb

01-07-2004, 03:12 PM

For my application, the frames are in different domains. This cannot be helped. I realize I will have to have the user grant privileges to this script. However, I do not intend to have the user grant any privileges to the foreign domain.

As long as the trusted domain is secure and has no malicious scripts, I think this mitigates the security risk.