I have a workign solution with Servoy which uses web client plugin and the Google Youtube API to perform Youtube searches of videos I but have some issues which I suspect are IE and Firefox security issues and am not sure how to solve them.
Bascially if I the web client runs IE 7 the code does work but I always get a pop up when I first run the solutuion from IE that states “The page is accessing information that is not under its control. This poses a security risk. Do you want to continue?”
If I say Yes , all is good and the code runs as expected.
If I run under IE 8 I get an error which states " Permission Denied wicket-ajax.js Code:0 followed by my servoy developer web lient URL".
If I use Firefox it hangs …
Any ideas how to resolve this, do I need to rewrite the API as its not reasonable to expect users to have to change browser security settings?
Has anyone done this ?
The code looks like :
var markup = '<script type="text/javascript" src="http://ajax.googleapis.com/\
ajax/libs/jquery/1.4.2/jquery.min.js"></script>\
<script type="text/javascript">'
.
.
.
markup += 'function doSearch(keyword,ind){'
markup += "var yt_url='http://gdata.youtube.com/feeds/api/videos?q='+keyword+'&format=5&start-index='+ind+'&max-results=10&v=2&alt=jsonc';"
markup += '$.ajax\
({\
type: "GET",\
url: yt_url,\
dataType:"jsonp",\
success: function(response)\
{\
{\
\
if(response.data.items)\
{\
var upd = response.data.items[0].id;'
markup += 'startIndex=response.data.startIndex;\
do some more stuff with the data returned ....
What you are trying to do is cross-site scripting: your page is hosted on domain A and in the background you call some AJAX functions on domain B.
Of course there are security restrictions for this!
As a user, you wouldn’t like to be browsing on a seemingly innocent blogpage.com page which would call an insertavirus.com script to execute in the background without your knowledge, would you?
The only way to do what you are trying to do here is to ask the Servoy server to access the other domain(s) and return what you need (thus acting as a proxy to the real scripts).
One way to do that would be to use a form in conjunction with the rest_ws plugin (Web services in Servoy, see the wiki for how to use), but I don’t remember if that plugin is capable of return jsonp, I think at some point there was a patch out there for this but there were some problems with the parameters to pass to the Servoy methods.
Another way would be to create your own (server-side) plugin that would do these proxy calls and return JSONP through a servlet.
This way the browser would only make Ajax calls to the domain where the page originates, thus eliminating these security issues…
And another thing: you really should put the jquery.js on the Servoy server as well (somehere in /server/webapps/ROOT) to avoid linking to another site when loading scripts, this might be considered a security issue as well.
ptalbot:
And another thing: you really should put the jquery.js on the Servoy server as well (somehere in /server/webapps/ROOT) to avoid linking to another site when loading scripts, this might be considered a security issue as well.
All I needed to do was put the jquery.min.js into the servoy server. It works fine now.
Glad to hear that, although are you sure that the Ajax call to http://gdata.youtube.com/feeds/api/videos is not going to be blocked by tighter security on your clients’ browsers than it is on yours?
I wouldn’t bet on that…