Frame busting buster does not fully work for IE

Question

I am working on a busting buster frame (called hehe) that left my users on my page and opened a new window with the destination URL. I am using a Lightbox script to display iframes, this is what I am doing:

1) Added event for all clicks .lightbox, fe:

$('.lightbox').live("click", function(e) { e.preventDefault(); $('#redirectURL').val($(this).attr('href')); $(this).lightbox(); } 

2) Added frame break separator:

 <script type="text/javascript"> var prevent_bust = 0 window.onbeforeunload = function() { prevent_bust++ } setInterval(function() { if (prevent_bust > 0) { prevent_bust -= 2 window.top.location = 'http://server-which-responds-with-204.com' } }, 1) </script> 

3) A modified frame breakdown code that fits my needs:

• determine if iframe wants to change window.top.location
• if so, prevent this using server 204 response
• open a new page: window.open( $('#redirectURL', '_blank' );
• close lightbox: $('.jquery-lightbox-button-close').click();

So far this is what I came up with:

 var prevent_bust = 0 window.onbeforeunload = function() { prevent_bust++ } setInterval(function() { if (prevent_bust > 0) { prevent_bust -= 2; redirectURL = $('#redirectURL').val(); if(redirectURL != "") { window.top.location = 'http://www.****.com/ajax/nocontent.php'; window.open(redirectURL, "_blank"); $('.jquery-lightbox-button-close').click(); $('#redirectURL').val(''); } else { window.top.location = 'http://www.****.com/ajax/nocontent.php'; } } }, 1); 

// EDIT: Before I forget, 'nocontent.php' is a file that returns a 204 header

For Firefox, it works when I programmed it, if a change is detected in the window.top.location window, it opens a new frame / page and does not allow the iframe to reload the top location and round it, it closes the jQuery illuminator.

Safari / Chrome works similarly, they open a new browser screen ( not sure if theres an option to say target="_newtab" or something? ). The only bad thing is that they don’t actually display a pop-up message, it’s blocked, but I can get around this by showing a pop-up on my site with a link to the page.

Internet Explorer is what a shocker is, the only black sheep. IE does not open a new popup and does not block window.top.location reset iFrame and just continues to refresh the full page to "#targetURL. It does the same with the default busting code .. so it is not due to some of my changes.

Anyone who can spot an error in my code?

In addition, I will need a small modification that will see if the request was processed by the iframe or by the user himself, because now the user has no way to disable my page by changing the address on the toolbar or by clicking on the link that LOL does not need.

Thanks in advance.

Answer 1

PENDO, I tried to simulate the whole process you described, ligthbox-jquery, javascript my own codes and manage open pages through a lightbox. I could not imitate at all, and as time runs out, I send a proposal to expand the range of possibilities and solutions. I suggest replacing the redirect page:

  ... redirectUrl = $ ('# redirectUrl'). val (); ... window.top.location = 'http://www .****. with / ajax / nocontent.php'; window.open (redirectUrl, "_blank"); 

Replaced by a DIV container that simulates a page using ajax calls and accepting the contents and overwriting the contents of the DIV.

  ... $.post(redirectoURL /* or desired URL */, function(data) { $('DIV.simulateContent').html(data); }); ... 

or

  ... $('DIV.simulateContent').load(redirectoURL); ... 

This approach also avoids the problem of preventing the user from even leaving your page using the address bar (as you yourself mentioned).

Sorry, let me give you a complete solution, but time has prevented me.

PENDO, working a bit more on alternatives to this problem, I found a custom jQuery lightbox plugin for working with custom windows (iframe, html, inline ajax, etc.). Maybe this will help. The following link:

  http://jacklmoore.com/colorbox/ 

Answer 2

If you do not need javascript running in your iframe in IE, you can set the iframe security attribute:

 <iframe security="restricted" src="http://domain.com" /> 

http://msdn.microsoft.com/en-us/library/ms534622(v=VS.85).aspx