You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shindig.apache.org by "Javier Pedemonte (JIRA)" <ji...@apache.org> on 2010/08/13 06:39:16 UTC
[jira] Created: (SHINDIG-1409) Security updates to RPC
Security updates to RPC
-----------------------
Key: SHINDIG-1409
URL: https://issues.apache.org/jira/browse/SHINDIG-1409
Project: Shindig
Issue Type: Improvement
Components: Javascript
Affects Versions: 2.0.0
Reporter: Javier Pedemonte
Priority: Minor
Fix For: 2.0.0
Add security features to the RPC layer, as described here:
http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Bastian Hofmann <ba...@googlemail.com>.
The "new" gadgets RPC works fine here with all browsers.
Cheers
Bastian
2010/9/2 Paul Lindner <li...@inuus.com>:
> Can you get a stacktrace from firebug?
>
> samplecontainer seems to be fine for me.
>
> On Sep 1, 2010, at 3:08 PM, Ziv Horesh wrote:
>
>> I am trying to sync with the latest shindig head and I start to get rpc
>> failures - rpc call from gadget to container doesn't pass through on firefox
>> (work fine on chrome.
>> Javier can you help verify?
>>
>> The gadget is simple:
>> <Module>
>> <ModulePrefs title="na">
>> <Require feature="rpc"/>
>> </ModulePrefs>
>> <Content type="html">
>> <script>
>> function call() {
>> gadgets.rpc.call(null, 'foo', null, 'bar');
>> }
>> </script>
>> <button id="button" onClick="call()">click</button>
>>
>> </Content>
>> </Module>
>>
>> And in the container I add the code (I have simple console div):
>>
>> gadgets.rpc.setRelayUrl('gadget', '
>> http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
>>
>> gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
>> gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
>> arguments); });gadgets.rpc.registerDefault(function() {
>> setConsoleWithService('default', arguments); });
>>
>> When I debug it in firebug I get a null targetWin (window.parent) which I
>> assume is the real problem.
>>
>> Thanks in advance
>>
>> Ziv
>>
>>
>>
>>
>> On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>>
>>>
>>> [
>>> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>>>
>>> Paul Lindner resolved SHINDIG-1409.
>>> -----------------------------------
>>>
>>> Resolution: Fixed
>>>
>>> committed
>>>
>>>> Security updates to RPC
>>>> -----------------------
>>>>
>>>> Key: SHINDIG-1409
>>>> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
>>>> Project: Shindig
>>>> Issue Type: Improvement
>>>> Components: Javascript
>>>> Affects Versions: 2.0.0
>>>> Reporter: Javier Pedemonte
>>>> Priority: Minor
>>>> Fix For: 2.0.0
>>>>
>>>>
>>>> Add security features to the RPC layer, as described here:
>>>>
>>> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
>>> .
>>>
>>> --
>>> This message is automatically generated by JIRA.
>>> -
>>> You can reply to this email to add a comment to the issue online.
>>>
>>>
>
>
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Bastian Hofmann <ba...@googlemail.com>.
The "new" gadgets RPC works fine here with all browsers.
Cheers
Bastian
2010/9/2 Paul Lindner <li...@inuus.com>:
> Can you get a stacktrace from firebug?
>
> samplecontainer seems to be fine for me.
>
> On Sep 1, 2010, at 3:08 PM, Ziv Horesh wrote:
>
>> I am trying to sync with the latest shindig head and I start to get rpc
>> failures - rpc call from gadget to container doesn't pass through on firefox
>> (work fine on chrome.
>> Javier can you help verify?
>>
>> The gadget is simple:
>> <Module>
>> <ModulePrefs title="na">
>> <Require feature="rpc"/>
>> </ModulePrefs>
>> <Content type="html">
>> <script>
>> function call() {
>> gadgets.rpc.call(null, 'foo', null, 'bar');
>> }
>> </script>
>> <button id="button" onClick="call()">click</button>
>>
>> </Content>
>> </Module>
>>
>> And in the container I add the code (I have simple console div):
>>
>> gadgets.rpc.setRelayUrl('gadget', '
>> http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
>>
>> gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
>> gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
>> arguments); });gadgets.rpc.registerDefault(function() {
>> setConsoleWithService('default', arguments); });
>>
>> When I debug it in firebug I get a null targetWin (window.parent) which I
>> assume is the real problem.
>>
>> Thanks in advance
>>
>> Ziv
>>
>>
>>
>>
>> On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>>
>>>
>>> [
>>> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>>>
>>> Paul Lindner resolved SHINDIG-1409.
>>> -----------------------------------
>>>
>>> Resolution: Fixed
>>>
>>> committed
>>>
>>>> Security updates to RPC
>>>> -----------------------
>>>>
>>>> Key: SHINDIG-1409
>>>> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
>>>> Project: Shindig
>>>> Issue Type: Improvement
>>>> Components: Javascript
>>>> Affects Versions: 2.0.0
>>>> Reporter: Javier Pedemonte
>>>> Priority: Minor
>>>> Fix For: 2.0.0
>>>>
>>>>
>>>> Add security features to the RPC layer, as described here:
>>>>
>>> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
>>> .
>>>
>>> --
>>> This message is automatically generated by JIRA.
>>> -
>>> You can reply to this email to add a comment to the issue online.
>>>
>>>
>
>
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Paul Lindner <li...@inuus.com>.
Can you get a stacktrace from firebug?
samplecontainer seems to be fine for me.
On Sep 1, 2010, at 3:08 PM, Ziv Horesh wrote:
> I am trying to sync with the latest shindig head and I start to get rpc
> failures - rpc call from gadget to container doesn't pass through on firefox
> (work fine on chrome.
> Javier can you help verify?
>
> The gadget is simple:
> <Module>
> <ModulePrefs title="na">
> <Require feature="rpc"/>
> </ModulePrefs>
> <Content type="html">
> <script>
> function call() {
> gadgets.rpc.call(null, 'foo', null, 'bar');
> }
> </script>
> <button id="button" onClick="call()">click</button>
>
> </Content>
> </Module>
>
> And in the container I add the code (I have simple console div):
>
> gadgets.rpc.setRelayUrl('gadget', '
> http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
>
> gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
> gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
> arguments); });gadgets.rpc.registerDefault(function() {
> setConsoleWithService('default', arguments); });
>
> When I debug it in firebug I get a null targetWin (window.parent) which I
> assume is the real problem.
>
> Thanks in advance
>
> Ziv
>
>
>
>
> On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>
>>
>> [
>> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>>
>> Paul Lindner resolved SHINDIG-1409.
>> -----------------------------------
>>
>> Resolution: Fixed
>>
>> committed
>>
>>> Security updates to RPC
>>> -----------------------
>>>
>>> Key: SHINDIG-1409
>>> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
>>> Project: Shindig
>>> Issue Type: Improvement
>>> Components: Javascript
>>> Affects Versions: 2.0.0
>>> Reporter: Javier Pedemonte
>>> Priority: Minor
>>> Fix For: 2.0.0
>>>
>>>
>>> Add security features to the RPC layer, as described here:
>>>
>> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
>> .
>>
>> --
>> This message is automatically generated by JIRA.
>> -
>> You can reply to this email to add a comment to the issue online.
>>
>>
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Paul Lindner <li...@inuus.com>.
Can you get a stacktrace from firebug?
samplecontainer seems to be fine for me.
On Sep 1, 2010, at 3:08 PM, Ziv Horesh wrote:
> I am trying to sync with the latest shindig head and I start to get rpc
> failures - rpc call from gadget to container doesn't pass through on firefox
> (work fine on chrome.
> Javier can you help verify?
>
> The gadget is simple:
> <Module>
> <ModulePrefs title="na">
> <Require feature="rpc"/>
> </ModulePrefs>
> <Content type="html">
> <script>
> function call() {
> gadgets.rpc.call(null, 'foo', null, 'bar');
> }
> </script>
> <button id="button" onClick="call()">click</button>
>
> </Content>
> </Module>
>
> And in the container I add the code (I have simple console div):
>
> gadgets.rpc.setRelayUrl('gadget', '
> http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
>
> gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
> gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
> arguments); });gadgets.rpc.registerDefault(function() {
> setConsoleWithService('default', arguments); });
>
> When I debug it in firebug I get a null targetWin (window.parent) which I
> assume is the real problem.
>
> Thanks in advance
>
> Ziv
>
>
>
>
> On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>
>>
>> [
>> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>>
>> Paul Lindner resolved SHINDIG-1409.
>> -----------------------------------
>>
>> Resolution: Fixed
>>
>> committed
>>
>>> Security updates to RPC
>>> -----------------------
>>>
>>> Key: SHINDIG-1409
>>> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
>>> Project: Shindig
>>> Issue Type: Improvement
>>> Components: Javascript
>>> Affects Versions: 2.0.0
>>> Reporter: Javier Pedemonte
>>> Priority: Minor
>>> Fix For: 2.0.0
>>>
>>>
>>> Add security features to the RPC layer, as described here:
>>>
>> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
>> .
>>
>> --
>> This message is automatically generated by JIRA.
>> -
>> You can reply to this email to add a comment to the issue online.
>>
>>
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Ziv Horesh <zh...@gmail.com>.
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>
> [
> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>
> Paul Lindner resolved SHINDIG-1409.
> -----------------------------------
>
> Resolution: Fixed
>
> committed
>
> > Security updates to RPC
> > -----------------------
> >
> > Key: SHINDIG-1409
> > URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> > Project: Shindig
> > Issue Type: Improvement
> > Components: Javascript
> > Affects Versions: 2.0.0
> > Reporter: Javier Pedemonte
> > Priority: Minor
> > Fix For: 2.0.0
> >
> >
> > Add security features to the RPC layer, as described here:
> >
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
> .
>
> --
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>
>
Re: [jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by Ziv Horesh <zh...@gmail.com>.
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
On Mon, Aug 30, 2010 at 2:22 AM, Paul Lindner (JIRA) <ji...@apache.org>wrote:
>
> [
> https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel]
>
> Paul Lindner resolved SHINDIG-1409.
> -----------------------------------
>
> Resolution: Fixed
>
> committed
>
> > Security updates to RPC
> > -----------------------
> >
> > Key: SHINDIG-1409
> > URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> > Project: Shindig
> > Issue Type: Improvement
> > Components: Javascript
> > Affects Versions: 2.0.0
> > Reporter: Javier Pedemonte
> > Priority: Minor
> > Fix For: 2.0.0
> >
> >
> > Add security features to the RPC layer, as described here:
> >
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc
> .
>
> --
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>
>
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905270#action_12905270 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ziv Horesh updated SHINDIG-1409:
--------------------------------
Comment: was deleted
(was: I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
)
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ziv Horesh updated SHINDIG-1409:
--------------------------------
Comment: was deleted
(was: I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
)
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905268#action_12905268 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Bastian Hofmann (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905480#action_12905480 ]
Bastian Hofmann commented on SHINDIG-1409:
------------------------------------------
The "new" gadgets RPC works fine here with all browsers.
Cheers
Bastian
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (SHINDIG-1409) Security updates to RPC
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Lindner resolved SHINDIG-1409.
-----------------------------------
Resolution: Fixed
committed
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905289#action_12905289 ]
Paul Lindner commented on SHINDIG-1409:
---------------------------------------
Can you get a stacktrace from firebug?
samplecontainer seems to be fine for me.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12906000#action_12906000 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
Well it seems that at this point I still depend on previous behavior.
So I created a patch: http://codereview.appspot.com/2118045/
Which uses the same forcesecure flag to enable the extra checking of relay domain.
(I guess it can be done using another flag, but I try to minimize complexity here).
Please review and let me know what you think.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905718#action_12905718 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I think I finally found the root cause of my problem.
I commented out lines 88-99 in wpm.transport.js and now it works fine on FF for my container as well.
My container is served by a different domain then the gadget or the relay url.
We have multiple containers that like that, is this is intended change?
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905654#action_12905654 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
OK, I was able to get that test running, but I'm seeing a different error ("invalid auth token: XXXXXX vs undefined") and it happens on both Firefox and Chrome.
In this particular case, when the gadget implicitly calls gadgets.rpc.setupReceiver('..'), the RPC code then calls 'setupContainerGadgetContext()' because window.__isgadget is set to true. That function then passes an 'init' callback to gadgets.config, but the callback never seems to get called (and therefore the gadget isn't properly setup for RPC).
I don't know enough about the gadgets.config class, so I don't know why the 'init' callback isn't getting called.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905676#action_12905676 ]
Paul Lindner commented on SHINDIG-1409:
---------------------------------------
Hi Ziv, can you try modifying the values of java/common/conf/shindig.properties ?
I belive that there's a conflict between forced-libs and externalize:
shindig.gadget-rewrite.externalize-feature-libs=true
shindig.gadget-rewrite.default-forced-libs=core:rpc
With this setting the core:rpc libraries load first, and then the gadget specific features are loaded afterwards. This leads to multiple js script tags.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905276#action_12905276 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12898075#action_12898075 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
Patch is at: http://codereview.appspot.com/1983044/show
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ziv Horesh updated SHINDIG-1409:
--------------------------------
Comment: was deleted
(was: I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
)
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12906902#action_12906902 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
I still think that you have an invalid scenario -- the relay url MUST be in the same domain as the container.
(1) If the container, gadget and relay are on 3 different domains, then how does wpm.transport even work for you? The postMessage call from the gadget->container will look like this:
window.parent.postMessage( rpc_data, relayUrl_origin )
But since "relayUrl_origin" is different than the origin of 'window.parent', the call should fail.
(2) The RMR and IFPC transports require that the relay be in the same domain, or they will not function.
(3) There was a TODO in the WPM transport to add code to check the incoming messages origin. I simply added that check.
Basically, the RPC code was architected to have the relayUrl in the same domain as the container.
The "forcesecure" flag was mainly added to enable extended security features (mainly unexpected unload detection) and depends on a valid, existing relay file. By putting the WPM security check inside of a check for "forcesecure == true", you are removing an important security check for the cases where the developer chose not to enable "forcesecure".
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ziv Horesh updated SHINDIG-1409:
--------------------------------
Comment: was deleted
(was: I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
)
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905669#action_12905669 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
Some more info on my previous comment:
First, I commented out the 'setupContainerGadgetContext()' call in rpc.js, so it would call 'setupContainerGenericIframe()' instead. With this change, the test worked just fine, on Firefox 3.6.
Next, did some debugging and found out that gadgets.config (and probably many other things) is being included twice inside the gadget context. What happens is that the call to register RPC with config happens first, but then another script with 'gadgets.config' class is loaded and overwrites the existing 'gadgets.config' structures -- this wipes out any previously registered callbacks.
Eventually, 'gadgets.config.init' is called, but the RPC callback is no longer registered. So the RPC service in the gadget context is never fully initialized.
If someone knows what's going on, please fix it. The HTML sent back from the server for the gadget loads the following two scripts:
<script src="http://localhost:8080/gadgets/js/rpc.js?container=default&nocache=0&debug=1&c=0&v=d18d1eba3b5cafbf214b5493863639ab"></script>
<script src="http://localhost:8080/gadgets/js/core:core.config:core.io:core.json:core.legacy:core.log:core.prefs:core.util:globals:shindig.auth.js?container=default&nocache=0&debug=1&c=0&v=fc6bca5e8a0854744d4323d8e828f975"></script>
Both contain an impl of 'gadgets.config', so the 2nd script overwrites the first. Not sure why the 2nd script is included.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905685#action_12905685 ]
Paul Lindner commented on SHINDIG-1409:
---------------------------------------
Yes, try this combination:
externalize-feature-libs=false
default-forced-libs=
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905369#action_12905369 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
Ziv:
If you are using recent versions of Firefox and Chrome then they should both be using the WPM transport and will use the same code. Can't think of any reason why Firefox would fail but Chrome succeed. How can 'window.parent' be null inside of an iframe?
You might try debugging on both browsers and see where the difference is.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905619#action_12905619 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
It took me a while but I managed to prove that for r990700 it works fine for me but for r990701 it does not work.
I tried using the shindig rpc test and it also show it works on chrome but not on FF 3.6
To recreate I changed rpctest_container.html:51 to be:
var gadgethost = 'http://' + window.location.host;
Then compiled and run the server (mvn -Prun)
In the browser opened http://host:8080/container/rpctest_container.html
When clicking on "Snc callback Test" and "Async Callback Test" on both container and gadget,
On chrome I see the result being updated, but on FF 3.6 it does not.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905264#action_12905264 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Javier Pedemonte (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905925#action_12905925 ]
Javier Pedemonte commented on SHINDIG-1409:
-------------------------------------------
> My container is served by a different domain then the gadget or the relay url.
I don't think this is supported. Most of the transports require that the relay url be in the same domain as the container; otherwise, they wouldn't work. If not relay url is specified, then the container's location is used.
The thing that changed with this checkin is that I added a security check for the incoming message's origin (there was previously only a TODO, stating that the origin needed to be checked). In your case, I'm assuming it's failing because the container's origin is different than the relay url.
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905266#action_12905266 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
I am trying to sync with the latest shindig head and I start to get rpc
failures - rpc call from gadget to container doesn't pass through on firefox
(work fine on chrome.
Javier can you help verify?
The gadget is simple:
<Module>
<ModulePrefs title="na">
<Require feature="rpc"/>
</ModulePrefs>
<Content type="html">
<script>
function call() {
gadgets.rpc.call(null, 'foo', null, 'bar');
}
</script>
<button id="button" onClick="call()">click</button>
</Content>
</Module>
And in the container I add the code (I have simple console div):
gadgets.rpc.setRelayUrl('gadget', '
http://meron.mtv.corp.google.com:8080/gadgets/files/container/rpc_relay.html');
gadgets.rpc.setAuthToken('gadget', '6421089622916860021');
gadgets.rpc.register('foo', function() { setConsoleWithService('foo',
arguments); });gadgets.rpc.registerDefault(function() {
setConsoleWithService('default', arguments); });
When I debug it in firebug I get a null targetWin (window.parent) which I
assume is the real problem.
Thanks in advance
Ziv
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SHINDIG-1409) Security updates to RPC
Posted by "Ziv Horesh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905680#action_12905680 ]
Ziv Horesh commented on SHINDIG-1409:
-------------------------------------
Javier and Paul thanks for your help.
I found out I didn't verify it correctly, the shindig simple container work fine for me. But my container still fails.
Since my container use the old style setting, I used the uabackward=1, and still it works fine on shindig.
I am still looking to see what else is different between my container and shindig container to cause the failure.
Paul, what did you mean by changing the properties? to set externalize to false?
> Security updates to RPC
> -----------------------
>
> Key: SHINDIG-1409
> URL: https://issues.apache.org/jira/browse/SHINDIG-1409
> Project: Shindig
> Issue Type: Improvement
> Components: Javascript
> Affects Versions: 2.0.0
> Reporter: Javier Pedemonte
> Priority: Minor
> Fix For: 2.0.0
>
>
> Add security features to the RPC layer, as described here:
> http://wiki.opensocial.org/index.php?title=PubSub.next_Proposals#Secure_rpc.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.