svn commit: r883834 - in /incubator/shindig/trunk/features/src/main/javascript/features/rpc: rmr.transport.js wpm.transport.js

[jo...@apache.org]

Author: johnh
Date: Tue Nov 24 19:46:29 2009
New Revision: 883834

URL: http://svn.apache.org/viewvc?rev=883834&view=rev
Log:
RPC tweaks.

* For RMR, trust the relay URL if it's explicitly passed in, using it as the relay for the transport. This makes it possible to fix scenarios in which site owners hosting robots.txt with framebusting code, which would break the container when executed.
* For WPM, also trust the relay URL that's passed in. Otherwise fall back to params.parent. In either case, use the origin of this param.


Modified:
    incubator/shindig/trunk/features/src/main/javascript/features/rpc/rmr.transport.js
    incubator/shindig/trunk/features/src/main/javascript/features/rpc/wpm.transport.js

Modified: incubator/shindig/trunk/features/src/main/javascript/features/rpc/rmr.transport.js
URL: http://svn.apache.org/viewvc/incubator/shindig/trunk/features/src/main/javascript/features/rpc/rmr.transport.js?rev=883834&r1=883833&r2=883834&view=diff
==============================================================================
--- incubator/shindig/trunk/features/src/main/javascript/features/rpc/rmr.transport.js (original)
+++ incubator/shindig/trunk/features/src/main/javascript/features/rpc/rmr.transport.js Tue Nov 24 19:46:29 2009
@@ -125,13 +125,17 @@
     channelFrame.id = 'rmrtransport-' + frameId;
     channelFrame.name = channelFrame.id;
 
-    // Determine the relay uri by taking the existing one,
-    // removing the path and appending robots.txt. It is
-    // not important if robots.txt actually exists, since RMR
-    // browsers treat 404s as legitimate for the purposes of
-    // this communication.
-    var relayUri =
-        gadgets.rpc.getOrigin(gadgets.rpc.getRelayUrl(frameId)) + '/robots.txt';
+    // Use the explicitly set relay, if one exists. Otherwise,
+    // Construct one using the parent parameter plus robots.txt
+    // as a synthetic relay. This works since browsers using RMR
+    // treat 404s as legitimate for the purposes of cross domain
+    // communication.
+    var relayUri = gadgets.rpc.getRelayUrl(frameId);
+    if (!relayUri) {
+      relayUri =
+          gadgets.rpc.getOrigin(gadgets.util.getUrlParameters()["parent"]) +
+          '/robots.txt';
+    }
 
     rmr_channels[frameId] = {
       frame: channelFrame,

Modified: incubator/shindig/trunk/features/src/main/javascript/features/rpc/wpm.transport.js
URL: http://svn.apache.org/viewvc/incubator/shindig/trunk/features/src/main/javascript/features/rpc/wpm.transport.js?rev=883834&r1=883833&r2=883834&view=diff
==============================================================================
--- incubator/shindig/trunk/features/src/main/javascript/features/rpc/wpm.transport.js (original)
+++ incubator/shindig/trunk/features/src/main/javascript/features/rpc/wpm.transport.js Tue Nov 24 19:46:29 2009
@@ -83,7 +83,9 @@
     call: function(targetId, from, rpc) {
       var targetWin = targetId === '..' ? window.parent : window.frames[targetId];
       // targetOrigin = canonicalized relay URL
-      var origin = gadgets.rpc.getOrigin(gadgets.rpc.getRelayUrl(targetId));
+      var origRelay = gadgets.rpc.getRelayUrl(targetId) ||
+                      gadgets.util.getUrlParameters()["parent"];
+      var origin = gadgets.rpc.getOrigin(origRelay);
       if (origin) {
         targetWin.postMessage(gadgets.json.stringify(rpc), origin);
       } else {