homepage Welcome to WebmasterWorld Guest from 184.73.104.82
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor 2014
Home / Forums Index / Code, Content, and Presentation / HTML
Forum Library, Charter, Moderators: incrediBILL

HTML Forum

    
Need to Have Parent Scroll to Top When iFrame Opens
XSS issue iFrame call MUST be Relative
TheMadScientist

WebmasterWorld Senior Member themadscientist us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 4125564 posted 10:29 pm on May 1, 2010 (gmt 0)

This post is in response to this 'not so recent thread' [webmasterworld.com...] because I did not see the fix posted and had to do it myself.

There is an XSS issue with allowing an iFrame to control a parent window, so the iFrame must reference a relative URL.

<iframe src="/the-iframe-source/page.html">

Using the preceding, the following in the <body> tag of the iFrame should work in most major browsers. (AFAIK)

<body onLoad="window.parent.scroll(0,0);">

NOTE: This is currently being tested, so if anyone notices (or knows) of a necessary difference, please post, and I'll post again if there are issues noticed or it's necessary to make any changes, but currently it seems to be working well.

EDITED TO: window.parent.scroll(0,0); to be 'more correct'.

 

tangor

WebmasterWorld Senior Member tangor us a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month



 
Msg#: 4125564 posted 11:09 pm on May 1, 2010 (gmt 0)

You continue to live up to your nom de plume, MadScientist!

Personally don't use iFrames (I'm a Frameset kind of guy...joking a bit, but not by much), but this is intriguing!

TheMadScientist

WebmasterWorld Senior Member themadscientist us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 4125564 posted 11:24 pm on May 1, 2010 (gmt 0)

You continue to live up to your nom de plume, MadScientist!

Phew! I honestly actually hesitated when I signed up for it, because I wasn't sure if I could do it or not, glad to know someone thinks I'm pulling it off because it's one of those names you kind of have to be able to live up to IMO. Thanks :)

[edited by: TheMadScientist at 11:29 pm (utc) on May 1, 2010]

tedster

WebmasterWorld Senior Member tedster us a WebmasterWorld Top Contributor of All Time 10+ Year Member



 
Msg#: 4125564 posted 11:25 pm on May 1, 2010 (gmt 0)

Thanks much - I added a note to the original thread linking it here.

TheMadScientist

WebmasterWorld Senior Member themadscientist us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 4125564 posted 11:28 pm on May 1, 2010 (gmt 0)

Thanks Tedster! I figured it was something people would want to know there is a solution for without having to completely change tactics.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / HTML
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved