Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!news.teledata-fn.de!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type: text/plain; charset="ISO-8859-1"
Message-ID: <1895059.lkMUc99Mlk@PointedEars.de>
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Organization: PointedEars Software (PES)
Date: Fri, 10 Jan 2014 18:05:26 +0100
User-Agent: KNode/4.11.3
Content-Transfer-Encoding: 7Bit
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject: Re: AJAX using local
Newsgroups: comp.lang.javascript
References: <7L6dnSGUUJE1hVLPnZ2dnUVZ_vydnZ2d@westnet.com.au> <2682810.tskAjyEyLv@PointedEars.de> <HoednRdin6yQrVLPnZ2dnUVZ_uOdnZ2d@westnet.com.au> <4863656.Y3eb4HivdN@PointedEars.de>
MIME-Version: 1.0
Lines: 45
NNTP-Posting-Date: 10 Jan 2014 18:05:30 CET
NNTP-Posting-Host: 97391a54.newsspool4.arcor-online.net
X-Trace: DXC=X@ej:39H^lZV;Ef1`Jk54\4IUK<Cl32<Q4Fo<]lROoRQ8kF<OcfhCO[^h?K5if;]b[DZm8W4\YJN\YUVHKH;GI^W7E`=ViMoo]So0<F=OIJ:4V
X-Complaints-To: usenet-abuse@arcor.de
Xref: csiph.com comp.lang.javascript:22556

Thomas 'PointedEars' Lahn wrote:

>> I know how to query a window's opener from the window but if the course
>> can only make a call like
>> 
>> var xhr = new XMLHttpRequest();
>> xhr.open('get', 'http://www.track.com/the/project.php?find=progress');
>> xhr.send();
>> 
>> how does it get info from the window opener?
> 
> It cannot.

Rethinking this, my answer is not wrong, but if the access policy is open 
for small allowances, there are possibilities (without claim of 
completeness):

- The opener code can open the course window providing vital information in
  the course URI, provided the parameters used by the opener are not used
  by the course already.  The course code can then process document.URL or
  window.location;

- (Not recommended) The opener code can set the name of the course window
  to include vital information, and the course code can read window.name.

Either of the former two approaches may create a security leak if the vital 
information includes privileged information.

- If the opener document and the course document are within the same
  second-level domain, the opener code can set a cookie with that domain
  before opening the course window, and the course code can read it:

- Likewise, the opener code can set local storage or session storage
  data before, after which the course code can read it.  This should
  be preferred to cookies.

In any case, compliant with Cookie laws, with the former two approaches the 
user may need to be informed that such information is being stored on their 
machine.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.