Controlling JavaScript across frames

[tombraun]

Hello!

This is my first posting here! :-) I hope you can help me...

To sum it up:
I have a question about the possibility to influence the execution of JavaScript in another frame. I cannot modify that other frame's code, but it does come from the same server. Therefore, there should not be an issue with any cross-side scripting restrictions.

In more detail:
I am working with a legacy web-app (strange as this may sound), which generates HTML with various more or less fixed programs. For a variety of reasons, we do not really want to mess with the source code of that application. Doing so would complicate things, make things terribly expensive, etc.

Yet, we would like to put the output of this old application into the new navigation framework that we are designing. And quite literally, we are using frames for that.

Unfortunately, the people who wrote the original code thought they'd be very clever by putting frame-break-out code into their output. For the most part, this simply looks like this:

if (window != window.top) {
    window.top.location = window.location;
}
 

The formatting is not always that nice, and there are variations, but for the most part, that's what it is.

I don't want to disable JavaScript, and preferably, I also don't want to have to parse through all the content of the other frame, since this would be very messy.

But since my frame and frameset code will be served from the same server and domain as the legacy code, could I do something before or while that other frame loads, which would 'trick' this other frame into thinkig that it is indeed on top?

Any help would be greatly appreciated.

Thank you very much!

Tom

[acoder]

Interesting problem.

Usually, force-frame scripts involve modifying the child pages. If this is added on load, you can overwrite the onload by setting window.onload to null. If that's not possible, you can try replacing any line which sets window.top.loca tion or top.location with a comment, i.e. put // before those lines, using server-side code.

[rnd me]

i think object tags have a different behavior, it might be possible to restrict them more?

you could also ajax in the url, and place it in a data url, and set the iframe to that.
that breaks the parent connection, because its from a different domain and protocol.

also an anon pop-up might work...