Anyone else experience issue in FF 23.0.1 with MooTools Core 1.4.5 & MooTools More 1.4.0.1?

[Jack Drysdale Jr]

Hello, everyone.

I'm new to MooTools (started working here in July 2013; I'm from a jQuery background), and have just started experiencing an issue that didn't exist before upgrading a testing FF browser to 23.0.1.

This issue is only in FireFox v23.0.1, not IE7/8/9/10, nor in Chrome 24, and did not exist in FireFox v21.0.1.

The project has several included .js files that are MooTools classes created by a previous programmer.  One is for modal popup windows.  Up until now, it has worked flawlessly.

In FF23.0.1, whenever a user tries to close the modal by either the "X" in the corner, or by clicking "SAVE" in the form contained within the modal, FireBug reports "parent.frames[win.name].$ is not a function."

The lines around the line in question are:

 

hide: function(){
  var win = this;
  parent.frames[win.name].$('id_of_container').setStyle('display','none');  // This is the line throwing the error.
  win.popup.addClass('hidden');
  }

Has anyone else experienced anything simliar, after a FF upgrade?

Thank you,

JD

[Sanford Whiteman]

Can you please provide (preferably) a jsFiddle with your modal class
in it to demo the problem, or at the very least a link to the .js
file? While I have a pretty good idea what the problem is, I can't
really debug something without the library code.

-- Sandy

[Jack Drysdale Jr]

Unfortunately, I cannot provide a link, as this is a secure application that requires a login and there are no "demo" accounts.

Plus, it's for DoD; my development system is isolated from the internet, so I can't copy/paste anything.  The .js file that creates the class is quite large (340 lines of code.)

I can check to see if I can access jsfiddle (so many sites are blocked from this network.)  If I can, I can pseudo-code my best.

JD

--

---
You received this message because you are subscribed to a topic in the Google Groups "MooTools Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/mootools-users/MG6-fp0a6ZI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to mootools-user...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[Jack Drysdale Jr]

I accidentally replied to the email instead of coming directly here; if this is a duplicate, I apologize.  Below is my emailed response:

Unfortunately, I cannot provide a link, as this is a secure application that requires a login and there are no "demo" accounts.

Plus, it's for DoD; my development system is isolated from the internet, so I can't copy/paste anything.  The .js file that creates the class is quite large (340 lines of code.)

I can check to see if I can access jsfiddle (so many sites are blocked from this network.)  If I can, I can pseudo-code my best.

JD

[Jack Drysdale Jr]

jsFiddle is blocked, I cannot access it from work.  :(

[Sanford Whiteman]

> Plus, it's for DoD; my development system is isolated from the
> internet, so I can't copy/paste anything.  The .js file that creates
> the class is quite large (340 lines of code.)

Doesn't matter to me how big it is, but there's no way to fix it if I
can't see it.

-- S.

[Dimitar Christoff]

well. few things to check without code. first make sure `this` references your window global object, unclear on how you call hide and what it's bound to. and that window.name is not undefined, unlikely to have been changed to read only but you never know. then try to loop through `parent.frames[win.name]` enumerable global properties to ensure mootools is actually there and available. you are calling it on the other object directly rather than reusing local one and passing a new context. 

look through changelog for FF as well to see if any significant bugs or issues have been addressed or what has been reported. also may be applicable mootools version used.

--
 
---
You received this message because you are subscribed to the Google Groups "MooTools Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mootools-user...@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
Dimitar Christoff

"JavaScript is to JAVA what hamster is to ham"
@D_mitar - https://github.com/DimitarChristoff

[Jack Drysdale Jr]

The following is the best I can do, unfortunately:

var modalWin = new Class({
  Implements: [Events,Options],
  options: {
      //defaults width, height, closeable, draggable, title, etc.
  },
  initialize: function(options){
      var win = this;
      //sets name, options, creates modal but hides it
  },
  show: function(){
      var win = this;
      win.fireEvent('beforeshow', {target: win.popup});
      var url = win.options.url;
      if(typeof(parent.frames[win.name]) == 'window'){
          //setStyle display; document.location.href = url;
          }
      else{
          win.popupContent.empty().adopt(
              //new Element().setStyles();
              );
          }
      win.curtain.removeClass('hidden');
      win.repositionWindow();
      win.popup.removeClass('hidden');
      win.fireEvent('aftershow',{target: win.popup});
      return win;
       }),

hide: function(){
      var win = this;

      win.fireEvent('beforehide', {target: win.popup});
      parent.frames[win.name].$('idofcontainer').setStyle('display','none');
      win.popup.addClass('hidden');
      var visibleWindows = win.curtain.getElements('.windowPopup').filter(function(e){ return !e.hasClass('hidden')});
      if(visibleWindows.length == 0){
          win.curtain.addClass('hidden');
          }
      else{
          visibleWindows.each(function(thisWindow){
              thisWindow.setStyle('z-index',(thisWindow.getStyle('z-index').toInt() == 49 ? 51 : thisWindow.getStyle('z-index').toInt() + 1)
              );
              });
          }
      win.fireEvent('afterhide', {target: win.popup});
      return win;
      },
setTitle: function(content){},  // too much code to type
getTitle: function(){},  // too much code to type
setURL: function(newURL){},   // too much code to type
repositionWindow: function(){},   // too much code to type
setHeight: function(newHeight){},  // too much code to type
setWidth: function(newWidth){}  // too much code to type
});

[Jack Drysdale Jr]

I'll check the 'this' and the 'window.name' and the loop.  How do I look through FF changelog?

Thanks,

JD

To unsubscribe from this group and stop receiving emails from it, send an email to mootools-users+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

[Sanford Whiteman]

> // too much code to type

Seriously?

Normally I'd jump to help out, but if you can't provide the actual
code I'm gonna back off.

Like Dimitar said,check the changelog http://www.mozilla.org/en-US/firefox/23.0/releasenotes/

You might look into the change regarding CSP: http://www.w3.org/TR/CSP/

Also, there's something smelly here:

parent.frames[win.name].$('idofcontainer')

I would usually expect `idofcontainer` to be a variable name, not a
value. There's definitely some cobbling-together here and elsewhere in
the snippet you provided.

-- S.

[Jack Drysdale Jr]

I'm sorry.. do YOU have time to type 340 lines of code to get help with something that you're having issues with??  I seriously doubt it.

No, 'idofcontainer' isn't a variable name, but an arbitrary name instead of the actual id of the element - DoD likes to be paranoid about security, so I'm paranoid for them.

You are the one who said that you suspect you know what it is - now you wash your hands of it.  Fine.. anyone else think they suspect what the issue could be?

It sucks being a developer in civil service - sorry to ruin your day.

[Dimitar Christoff]

sorry `window.name` would mean nothing - your naming convention is misleading. `win = this` points to your instance. should be `self` :) so it looks as if mootools or at least `$` is unavailable on the parent frame. you can still achieve the same result by using vanilla js - `parent.frames[this.name].document.getElementById('someid').style.display = 'none';`

https://www.mozilla.org/security/known-vulnerabilities/firefox.html - a number of security fixes in for XSS and masquerading document.uri that may have affected you - is the popup in the same origin (domain/port/protocol)?

To unsubscribe from this group and stop receiving emails from it, send an email to mootools-user...@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

[Sanford Whiteman]

> I'm sorry.. do YOU have time to type 340 lines of code to get help
> with something that you're having issues with?? I seriously doubt it.

If I couldn't fix it myself, sure. Such are the terms and conditions
of getting free support.

> You are the one who said that you suspect you know what it is - now
> you wash your hands of it. Fine.. anyone else think they suspect
> what the issue could be?

My suspicion, like Dimitar's, was simply that you have a cross-frame
XSS issue (which you should've picked up yourself from the error
message: since MooTools is loading in other browsers, that suggests
$() is being blocked for security reasons rather than not being
attached to the frame). I can't know what it is exactly with a tiny
bit of code that is further obfuscated.

I gave you links to follow, so quit accusing me of washing my hands of
"it" since you didn't provide an "it."

> It sucks being a developer in civil service - sorry to ruin your day.

I come from a family of civil servants and soldiers, so I have plenty
of experience with egress filtering. I just wouldn't expect free code
help if I couldn't get example code out of the building.

-- S.

[Sanford Whiteman]

Check for mixed content, as it is possible you missed the popup the
first 3 times you loaded the page.

https://blog.mozilla.org/security/2013/05/16/mixed-content-blocking-in-firefox-aurora/

Also, from a cursory look at 21 -> 22 changelog there isn't anything
that jumps out as much as in 22 -> 23. But it is impossible to tell
without being able to observe the exact symptoms. Make sure you look
in the console as it may dump the error there.

[Rolf Langenhuijzen]

I'd try to target the element with plain js first, that should work no matter what, no? Like Dimitar said.

Please no hate towards Sandy here.. he has to work with old IE's a lot I think, so you can only have much respect for that ;) Besides that he's pretty awesome, even though I never spoke to him, judged solely by his involvement in this group.

If there's no code to look at, support is difficult (impossible a lot of times), you can't deny that... because isolated a method that throws the error could work, but inside a whole block of code who knows what happens.

MOO!

[Jack Drysdale Jr]

I inherited this from the developer that I replaced two months ago.  For every other custom created class (datagrids, etc.) the "var win = this" works fine, but I will give the "self" a shot to see if that makes any difference.  If not, then the vanilla js will (hopefully) be a band-aid solution until the issue is resolved.

Everything is (AFAIK) same origin/domain; I cannot think of any part of this web app that reaches to any other domain for anything.  We don't even use a CDN for MooTools; it's a local document.

Thank you,

JD

[kentaromiura]

That means that mootools is not loaded in the frame that code is trying to target.

parent.frames['frame_name'] just return a reference to that frame

(see http://www.jibbering.com/faq/#windows)

what happens now is that if that (i)frame doesn't load mootools, the reference to that frame window.$ is undefined, but since you are trying to call undefined('id_of_container') and undefined is not a function, FF will report that error.

if you try the same page in chrome you should see a message that should look like 

Uncaught TypeError: Object [object global] has no method '$'

[Jack Drysdale Jr]

Chrome is not erroring; the modals close without incident in Chrome24, IE v7-10, and FF21.  We have not tested it in FF22, but we aren't allowed to install anything and would have to submit a request to have FF22 installed, for testing.. and who knows how long that might take.  :)  It's only FF23.0.1 that has an issue with closing the modal, so suggestions that it could be a security patch in 23 are more probable.

Thank you,

JD

[Sanford Whiteman]

OP says it works in Chrome, which suggests that Moo is technically loaded in all cases but is hitting a security sandbox in FF.latest.‎ Unless there some browser sniffing code which prevents from even loading in some UAs.

-- S.

[kentaromiura]

While it can be possible that in case of security issues $ will be undefined, IIRC the error should be different (like Error: Permission denied to access property '$') or there should be a warning of cross-domain/protocol/port mismatch that the OP cannot see.
My guess is that in FF MooTools doesn't load right (eg could be a timing issue that in chrome doesn't happen) or that $ is obfuscated by something else.

[Sanford Whiteman]

> While it can be possible that in case of security issues $ will be
> undefined, IIRC the error should be different (like Error:
> Permission denied to access property '$')

That msg would constitute information leakage because you could use it
to tell the difference between a parent frame with $ and without. The
more secure way to do it is to give no error message except the
cross-frame violation -- I don't know if this has changed in FF but
I'll try to test later.

-- S.

[Jack Drysdale Jr]

Someone else took a look at it and discovered that (apparently) FF23 did not see something as a window that FF21 (and earlier) did.  It all came down to a conditional statement based upon an object typeof().  It now works in FF21, FF23, Chrome, and IE7-10.

JD