IE 8 "Access is denied" fckeditorcode_ie.js Line 86

Why didn't you report this problem while IE8 was still in beta?
I've been testing it and I haven't seen this problem, so you'll have to provide some info in order to reproduce the problem, but it might turn out that this is another bug in IE8 and now you'll have to suffer it for a very long time.

schleicher wrote:
But don't bother anymore. I'll solve the problem by myself somehow, as I always do...

We're seeing it too, and we're setting the document.domain.

http://apps.foo.com/...
http://www.foo.com/...
http://apps.foo.com/...

http://dev.fckeditor.net/ticket/3183

http://ajaxian.com/archives/ie-8-security

I've got sort of a hackaround in progress, but it's pretty ugly. Cleaning it up before posting it, but it is by no means the sort of thing that anyone would want to include in an official release :p

Figured I'd start getting your guys' feedback before I post it though, incase you have any suggestions for how to make it less disgusting.

The basic idea is that in fckeditor.html, before all the domain lowering takes place, I create a pool of 20 popups for later consumption. As I'm going through the domain loosening place, I hit each of the popups and loosen their domain before loosening the main one. This seems to work, but its slow creating all those 20 popups.

I just guessed at the number 20. It's probably too big, but the fun part is that you have to create them all upfront. Once you change document.domain for fckeditor.html, you can't create any more popups.
Any deterministic way to know ahead of time how many I'll actually need?

OK, here's my hack:

fckbrowserinfo.js: Add IE8 detection:

var FCKBrowserInfo =
{
   IsIE      : /*@cc_on!@*/false,
   IsIE8      : /*@cc_on!@*/false && ( parseInt( s.match( /msie (\d+)/ )[1], 10 ) >= 8 ),
   IsIE7      : /*@cc_on!@*/false && ( parseInt( s.match( /msie (\d+)/ )[1], 10 ) >= 7 ),
   IsIE6      : /*@cc_on!@*/false && ( parseInt( s.match( /msie (\d+)/ )[1], 10 ) >= 6 ),
   IsSafari   : s.Contains(' applewebkit/'),      // Read "IsWebKit"
   IsOpera      : !!window.opera,
   IsAIR      : s.Contains(' adobeair/'),
   IsMac      : s.Contains('macintosh')
} ;

fckeditor.html: Create popup pool and set document.domain accordingly:

var IsIE8 = /*@cc_on!@*/false && ( parseInt( navigator.userAgent.toLowerCase().match( /msie (\d+)/ )[1], 10 ) >= 8 );
// if IE8, setup a bunch of popups that use a domain we can touch....
var GLOBAL_POPUP_BUCKET_FCK_IE8 = [];
if(IsIE8){
      for(i=0; i<20; i++){
         GLOBAL_POPUP_BUCKET_FCK_IE8.push(window.createPopup());
      }
}


// Save a reference to the default domain.
var FCK_ORIGINAL_DOMAIN ;
var FCK_RUNTIME_DOMAIN ;
// Automatically detect the correct document.domain (#123).
(function()
{
   var d = FCK_ORIGINAL_DOMAIN = FCK_RUNTIME_DOMAIN = document.domain ;

   while ( true )
   {
      // Test if we can access a parent property.
      try
      {
         var test = window.parent.document.domain ;
         break ;
      }
      catch( e ) {}

      // Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
      d = d.replace( /.*?(?:\.|$)/, '' ) ;

      if ( d.length == 0 )
         break ;      // It was not able to detect the domain.

      try
      {
         // Before setting document.domain, set it for all the popups we've created.  I hope this fucking works....
         for(i=0; i < GLOBAL_POPUP_BUCKET_FCK_IE8.length; i++){
            GLOBAL_POPUP_BUCKET_FCK_IE8[i].document.domain = d;
         }
         
         document.domain = d ;
      }
      catch (e)
      {
         break ;
      }
   }
})() ;

var FCK_RUNTIME_DOMAIN = document.domain ;

var FCK_IS_CUSTOM_DOMAIN = ( FCK_ORIGINAL_DOMAIN != FCK_RUNTIME_DOMAIN ) ;

fckpanel.js: Use the popup pool if IE8, instead of creating new ones:

if ( FCKBrowserInfo.IsIE8 )
      {
         this._Popup = GLOBAL_POPUP_BUCKET_FCK_IE8.pop();

         oDocument = this.Document = this._Popup.document ;

         FCK.IECleanup.AddItem( this, FCKPanel_Cleanup ) ;
      }
      else if (FCKBrowserInfo.IsIE){
         // Create the Popup that will hold the panel.
         // The popup has to be created before playing with domain hacks, see #1666.
         this._Popup   = this._Window.createPopup() ;

         // this._Window cannot be accessed while playing with domain hacks, but local variable is ok.
         // See #1666.
         var pDoc = this._Window.document ;

         // This is a trick to IE6 (not IE7). The original domain must be set
         // before creating the popup, so we are able to take a refence to the
         // document inside of it, and the set the proper domain for it. (#123)
         if ( FCK_IS_CUSTOM_DOMAIN && !FCKBrowserInfo.IsIE7 )
         {
            pDoc.domain = FCK_ORIGINAL_DOMAIN ;
            document.domain = FCK_ORIGINAL_DOMAIN ;
         }

         oDocument = this.Document = this._Popup.document ;

         // Set the proper domain inside the popup.
         if ( FCK_IS_CUSTOM_DOMAIN )
         {
            oDocument.domain = FCK_RUNTIME_DOMAIN ;
            pDoc.domain = FCK_RUNTIME_DOMAIN ;
            document.domain = FCK_RUNTIME_DOMAIN ;
         }

         FCK.IECleanup.AddItem( this, FCKPanel_Cleanup ) ;
      }
      else
      {
         var oIFrame = this._IFrame = this._Window.document.createElement('iframe') ;
         FCKTools.ResetStyles( oIFrame );
         oIFrame.src               = 'javascript:void(0)' ;
         oIFrame.allowTransparency   = true ;
         oIFrame.frameBorder         = '0' ;
         oIFrame.scrolling         = 'no' ;
         oIFrame.style.width = oIFrame.style.height = '0px' ;
         FCKDomTools.SetElementStyles( oIFrame,
            {
               position   : 'absolute',
               zIndex      : FCKConfig.FloatingPanelsZIndex
            } ) ;

         this._Window.document.body.appendChild( oIFrame ) ;

         var oIFrameWindow = oIFrame.contentWindow ;

         oDocument = this.Document = oIFrameWindow.document ;

         // Workaround for Safari 12256. Ticket #63
         var sBase = '' ;
         if ( FCKBrowserInfo.IsSafari )
            sBase = '<base href="' + window.document.location + '">' ;

         // Initialize the IFRAME document body.
         oDocument.open() ;
         oDocument.write( '<html><head>' + sBase + '<\/head><body style="margin:0px;padding:0px;"><\/body><\/html>' ) ;
         oDocument.close() ;

         if( FCKBrowserInfo.IsAIR )
            FCKAdobeAIR.Panel_Contructor( oDocument, window.document.location ) ;

         FCKTools.AddEventListenerEx( oIFrameWindow, 'focus', FCKPanel_Window_OnFocus, this ) ;
         FCKTools.AddEventListenerEx( oIFrameWindow, 'blur', FCKPanel_Window_OnBlur, this ) ;
      }

Note that my previous workaround doesn't apply to IE8 in "compatibility view" mode. The same root bug is there in either, but my check for IsIE8 returns false in compatibility mode, so the workaround never gets invoked.

OK, replace IE8 detection as follows, and my workaround works in IE8 compatibility mode as well:

// IE8's "Compatibility mode" is anything but.  At least it doesn't take 40 lines of code to detect and work around it.
// Oh wait:
/*
 * Author: Rob Reid
 * CreateDate: 20-Mar-09
 * Description: Little helper function to return details about IE 8 and its various compatibility settings either use as it is
 * or incorporate into a browser object. Remember browser sniffing is not the best way to detect user-settings as spoofing is
 * very common so use with caution.
*/
function IEVersion(){
   var _n=navigator,_w=window,_d=document;
   var version="NA";
   var na=_n.userAgent;
   var ieDocMode="NA";
   var ie8BrowserMode="NA";
   // Look for msie and make sure its not opera in disguise
   if(/msie/i.test(na) && (!_w.opera)){
      // also check for spoofers by checking known IE objects
      if(_w.attachEvent && _w.ActiveXObject){      
         // Get version displayed in UA although if its IE 8 running in 7 or compat mode it will appear as 7
         version = (na.match( /.+ie\s([\d.]+)/i ) || [])[1];
         // Its IE 8 pretending to be IE 7 or in compat mode      
         if(parseInt(version)==7){            
            // documentMode is only supported in IE 8 so we know if its here its really IE 8
            if(_d.documentMode){
               version = 8; //reset? change if you need to
               // IE in Compat mode will mention Trident in the useragent
               if(/trident\/\d/i.test(na)){
                  ie8BrowserMode = "Compat Mode";
               // if it doesn't then its running in IE 7 mode
               }else{
                  ie8BrowserMode = "IE 7 Mode";
               }
            }
         }else if(parseInt(version)==8){
            // IE 8 will always have documentMode available
            if(_d.documentMode){ ie8BrowserMode = "IE 8 Mode";}
         }
         // If we are in IE 8 (any mode) or previous versions of IE we check for the documentMode or compatMode for pre 8 versions         
         ieDocMode = (_d.documentMode) ? _d.documentMode : (_d.compatMode && _d.compatMode=="CSS1Compat") ? 7 : 5;//default to quirks mode IE5                        
      }
   }
             
   return {
      "UserAgent" : na,
      "Version" : version,
      "BrowserMode" : ie8BrowserMode,
      "DocMode": ieDocMode
   }         
}
var ieVersion = IEVersion();
var IsIE8 = ieVersion.Version != "NA" && ieVersion.Version >= 8;

Now that's what I call compatible...

Tools > Internet Options > Security > Custom... > 'Run ActiveX controls and plug-ins'="Enabled"

dspring0021 wrote:Tools > Internet Options > Security > Custom... > 'Run ActiveX controls and plug-ins'="Enabled"

I'm not sure I follow. I can't exactly tell each of my users to change their security settings...

Still not been resolved, waiting FCK......

<meta http-equiv="X-UA-Compatible" content="IE=7" />

Actual verification that works in this case? Doesn't that just turn "compatibility mode" on?

The relevant bug here is a "security feature". Microsoft considers those an exception to the "act like IE7" rule.

joydark wrote:You can put

<meta http-equiv="X-UA-Compatible" content="IE=7" />

on your page and ie8 will works like ie7.
It's temporary fix while waiting FCK...

oferc wrote:I've implemented the code as suggested by vt_mruhlin and it works great in Ie8.
Only one problem, my production site works under HTTPS, and the solution doesn't work there.

Any idea why?

Ofer

http://stackoverflow.com/questions/1886 ... -object-of

viewtopic.php?f=6&t=13378&start=10

http://msdn.microsoft.com/en-us/library/dd567845%28VS.85%29.aspx

HI vt_mruhlin ,

Thanks for your help.Its working now.
what is the reason, (B=this.Document=this._Popup.document;) this code didnt work.
It is because of document.domain? Can you explain me.

Thanks
Raj

good idea. thanks for all the example.......

vt_mruhlin wrote:raj,

The problem with it reporting itself in IE7 is because it's going into "compatibility view mode". Since it's happening only on your server and not on your local environment, you might be on Microsoft's shit listhttp://msdn.microsoft.com/en-us/library/dd567845%28VS.85%29.aspx. Good luck getting your site removed from that

Did you try my hacks from previous posts? Make sure you get the second one, which specifically covers the case you're talking about, of IE8 incorrectly identifying as IE7.

Good infor.