javascript - Permission denied to access property 'Arbiter' - Stack Overflow

admin管理员组

文章数量:1356815

I have an iframe FB app. We have three places where we develop it: My localhost, stage server where we test the app, production server. Localhost and production have HTTPS. Localhost and stage apps have sandbox mode enabled. All versions of app are identical, code is the same. Stage and production are totally the same server machine with the same settings except of the HTTPS.

Now what is happening only at my stage server app: When I click on something where jQuery UI dialog should be summoned, it raises following error in my Firebug: Permission denied to access property 'Arbiter'. No dialog is summoned then. It's raised in somehow dynamically loaded canvas_proxy.php, within this code:

/**
 * Parses the fragment and calls Arbiter.inform(method, params)
 *
 * @author ptarjan
 */
function doFragmentSend() {
  var
    location = window.location.toString(),
    fragment = location.substr(location.indexOf('#') + 1),
    params = {},
    parts = fragment.split('&'),
    i,
    pair;

  lowerPageDomain();

  for (i=0; i<parts.length; i++) {
    pair = parts[i].split('=', 2);
    params[decodeURIComponent(pair[0])] = decodeURIComponent(pair[1]);
  }
  var p = params.relation ? resolveRelation(params.relation) : parent.parent;

  // The user is not inside a frame (probably testing on their own domain)
  if (p == parent || !p.Arbiter || !p.JSON) {
    return;
  }

  p.Arbiter.inform(
    'Connect.Unsafe.'+params.method,
    p.JSON.parse(params.params),
    getBehavior(p, params.behavior));
}

The line if (p == parent || !p.Arbiter || !p.JSON) { raises it. My script code linking the JS API looks like this:

<script src=".js#appId=APPID"></script>

Have anyone any clue why this could be happening? I found this and this, but these issues doesn't seem to be helpful to me (or I just don't get it). Could it be because of the HTTPS? Why it worked the day before yesterday? I am desperate :-(

I have an iframe FB app. We have three places where we develop it: My localhost, stage server where we test the app, production server. Localhost and production have HTTPS. Localhost and stage apps have sandbox mode enabled. All versions of app are identical, code is the same. Stage and production are totally the same server machine with the same settings except of the HTTPS.

Now what is happening only at my stage server app: When I click on something where jQuery UI dialog should be summoned, it raises following error in my Firebug: Permission denied to access property 'Arbiter'. No dialog is summoned then. It's raised in somehow dynamically loaded canvas_proxy.php, within this code:

/**
 * Parses the fragment and calls Arbiter.inform(method, params)
 *
 * @author ptarjan
 */
function doFragmentSend() {
  var
    location = window.location.toString(),
    fragment = location.substr(location.indexOf('#') + 1),
    params = {},
    parts = fragment.split('&'),
    i,
    pair;

  lowerPageDomain();

  for (i=0; i<parts.length; i++) {
    pair = parts[i].split('=', 2);
    params[decodeURIComponent(pair[0])] = decodeURIComponent(pair[1]);
  }
  var p = params.relation ? resolveRelation(params.relation) : parent.parent;

  // The user is not inside a frame (probably testing on their own domain)
  if (p == parent || !p.Arbiter || !p.JSON) {
    return;
  }

  p.Arbiter.inform(
    'Connect.Unsafe.'+params.method,
    p.JSON.parse(params.params),
    getBehavior(p, params.behavior));
}

The line if (p == parent || !p.Arbiter || !p.JSON) { raises it. My script code linking the JS API looks like this:

<script src="https://connect.facebook/en_US/all.js#appId=APPID"></script>

Have anyone any clue why this could be happening? I found this and this, but these issues doesn't seem to be helpful to me (or I just don't get it). Could it be because of the HTTPS? Why it worked the day before yesterday? I am desperate :-(

• javascript
• facebook

Share Improve this question Follow edited May 23, 2017 at 11:55 CommunityBot 111 silver badge asked Jan 6, 2012 at 12:43 Honza JavorekHonza Javorek 8,82688 gold badges4949 silver badges6767 bronze badges 7

• 1 Not yet. We are waiting a bit if it's permanent or if it's some kind of Facebook Platform turbulence. – Honza Javorek Commented Jan 7, 2012 at 13:51
• Is there a bug for this submitted yet to Facebook? – Jared Hales Commented Jan 31, 2012 at 16:30
• Could it be a document domain issue? – Dai Bok Commented Feb 1, 2012 at 13:43
• @DaiBok I am very sorry, but I don't understand much the words "document domain issue". What exactly do you mean by this? Thank you. – Honza Javorek Commented Feb 3, 2012 at 20:33
• Have you heard of same origin policy? Sometimes when creating iframes, especially dynamically, they may be created under a different document domain and you land up getting permission errors , have a read through this, developer.mozilla/En/Same_origin_policy_for_JavaScript and there are quite a few solutions and fixes on google. – Dai Bok Commented Feb 6, 2012 at 9:37

 |  Show 2 more ments

1 Answer 1

Sorted by: Reset to default 7

whenever you have a permission denied message and you are dealing with frames or iframes, it's a document domain issue. One document belongs to domain x and the other is domain y. And notice that www.domain. and domain. are not the same document domains!

When you are tapping into the DOM of one framed document from another one, (whether it is for the purpose of changing the values of a page element or simply reading the values of some hidden variable or url etc), you will get a permission denied message unless both framed documents are served from the same/identical domains.

So, if one frame belongs to www.mydomain. and the other happens to be just mydomain. or www.someotherdomain., you get that bloody permission denied error.

And there is no way around it. And If there were, the identity theft problem would have sky-rocketed in no time.

本文标签： javascriptPermission denied to access property 39Arbiter39Stack Overflow