Know if element is in iframe

Andrew Poulos

unread,

May 1, 2013, 7:49:32 PM5/1/13

to

I have a page with an iframe. The some elements in the page in the
iframe call a function in the parent page and pass 'this' to it eg.

<span onclick="window.parent.func(this);">blah</span>

When I put an alert on the parameter in func I get
[object HTMLSpanElement]
irrespective of whether the element is in the iframe or the parent page.

How can I distinguish between the two?

Andrew Poulos

Thomas 'PointedEars' Lahn

unread,

May 1, 2013, 8:19:22 PM5/1/13

to

var thisDocument = document;

function func (target)
{
if (target.ownerDocument == thisDocument)
{
/* target is in the frameset document */
}
}

If the “ownerDocument” property was unavailable, you could compare the
references to the root element objects by traversing the trees upwards by
“parentNode”.

I strongly recommend not to attach vital functionality to “div” and “span”
elements.

--
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

Stefan Weiss

unread,

May 1, 2013, 8:32:13 PM5/1/13

to

On 2013-05-02 02:19, Thomas 'PointedEars' Lahn wrote:
> I strongly recommend not to attach vital functionality to “div” and “span”
> elements.

Why not?

- stefan

Thomas 'PointedEars' Lahn

unread,

May 1, 2013, 8:34:54 PM5/1/13

to

Because that does not work everywhere.

JJ

unread,

May 2, 2013, 1:31:51 AM5/2/13

to

On Thu, 02 May 2013 02:34:54 +0200, Thomas 'PointedEars' Lahn wrote:
> Because that does not work everywhere.

I don't see anything wrong with it.
Could you provide some examples?

Denis McMahon

unread,

May 2, 2013, 10:41:06 AM5/2/13

to

On Thu, 02 May 2013 09:49:32 +1000, Andrew Poulos wrote:

> I have a page with an iframe. The some elements in the page in the
> iframe call a function in the parent page and pass 'this' to it eg.

Is this a frame security thing? If the content of the iframe is not from
the same host as the main page, I believe xss security prevents scripts
from either manipulating the other?

I've never tried communicating between an iframe and a parent docuemnt,
but (a long time, several years ago) I wrote some code that happily
communicated between frames in a frameset - is communication between
parent and child fundamentally different to that between a frameset and
a frame's content?

--
Denis McMahon, denismf...@gmail.com

Thomas 'PointedEars' Lahn

unread,

May 2, 2013, 3:03:20 PM5/2/13

to

Denis McMahon wrote:

> On Thu, 02 May 2013 09:49:32 +1000, Andrew Poulos wrote:
>> I have a page with an iframe. The some elements in the page in the
>> iframe call a function in the parent page and pass 'this' to it eg.
>
> Is this a frame security thing?

Unlikely here.

> If the content of the iframe is not from the same host as the main page,
> I believe xss security prevents scripts from either manipulating the
> other?

No, the Same Origin Policy (SOP) prevents that if the content of the iframe
is not _accessed using_ the same URI scheme, _host name_ (that is, domain
name, regardless where the content is hosted), or port number.

XSS is a related, but different concept; it can be used to bypass the SOP.

<http://en.wikipedia.org/wiki/Cross-site_scripting>

> I've never tried communicating between an iframe and a parent docuemnt,
> but (a long time, several years ago) I wrote some code that happily
> communicated between frames in a frameset - is communication between
> parent and child fundamentally different to that between a frameset and
> a frame's content?

No.

Dr J R Stockton

unread,

May 3, 2013, 3:03:46 PM5/3/13

to

In comp.lang.javascript message <28497692....@PointedEars.de>,
Thu, 2 May 2013 21:03:20, Thomas 'PointedEars' Lahn <Point...@web.de>
posted:

>No, the Same Origin Policy (SOP) prevents that if the content of the iframe
>is not _accessed using_ the same URI scheme, _host name_ (that is, domain
>name, regardless where the content is hosted), or port number.

It also erroneously prevents access if the page is being displayed
locally (e.g. <file://localhost/c:/homepage/$.htm> (Opera
representation) and is showing equally local content in the iframe [OK
so far] AND the browser is current/recent Chrome (I see it in WinXP
sp3).

--
(c) John Stockton, Surrey, UK. �@merlyn.demon.co.uk Turnpike v6.05 MIME.
Web <http://www.merlyn.demon.co.uk/> - FAQish topics, acronyms, & links.
Proper <= 4-line sig. separator as above, a line exactly "-- " (SonOfRFC1036)
Do not Mail News to me. Before a reply, quote with ">" or "> " (SonOfRFC1036)

Stefan Weiss

unread,

May 6, 2013, 1:57:17 PM5/6/13

to

I guess not.

- stefan

Thomas 'PointedEars' Lahn

unread,

May 7, 2013, 4:09:23 AM5/7/13

to

Guess again.