function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
DILIP KUMAR MISTRYDILIP KUMAR MISTRY 

Cross Domain Scripting Issue

Hi Friends,

 

I am using agent console for account. Actually I have override the account detail page by my custom page "AccountDetailExt". When I click console tab then i found all the accounts and can view the details of an account in main middle iframe. But when i click on any related objects for this account it gives me java-script  error instead of showing them in the detail window and account details in "mini view" iframe.

 

So my console contains:

1. List View: All accounts

2. Detail View: Detail of account with its related lists (accounts domain is c.na7.salesforce.com)

3. Mini View: I cant see anything in this iframe.  (standard sf domain na7.salesforce.com)

 

when i click any contact/ other related object link then it show me the js error in error console. the error is

"Error: permission denied for <https://c.na7.salesforce.com> to get property Window.ffInAlert from <https://na7.salesforce.com/home/home.jsp>" 

 

 

please help me to get the mini view iframe for the console.

 

Thanks in advanced.

 

~Dilip Mistry

 

 

werewolfwerewolf
The mini view in the console does not work with Visualforce pages due to the precise issue you mentioned:  cross-site scripting will not allow it.  There is no way you can make that work.
NBlasgenNBlasgen

You can disable XSS filters on certian browsers.  I, as warewolf says, would not suggest this to the point of saying that it is impossible.  But since I personally wish that there was the ability to give permission to certian sites to get around XSS, at least am willing to admit that it is possible to get around this.

 

http://a4apphack.com/index.php/security/disabling-default-xss-filtering-in-ie8-for-security-testers

 

And other browsers have similar things.