If you own all of the websites, including your upload server and the website you're deploying the uploader to, then perhaps some simple DNS tricks can help you overcome.
- Let's say for example your upload server domain is:
upload.example.com
.
- Let's say your server is
www.example.com
.
In the above case, you can enable cross site scripting by setting the document.domain property:
document.domain = "example.com";
This allows www.example.com to communicate with the upload.example.com iframe.
The ability to communicate between subdomains can help you communicate between other web servers, assuming that you own the websites.
What do you do if the domains are different?
Let's assume the following:
upload.example.com
is your upload server.
www.domain.com
is your website that is the parent document containing the uploader iframe.
Now, again, we're assuming you own both of these domain names, or at least have access to the settings. Using what we know above about enabling cross-site scripting on subdomains, you can use some DNS tricks to help.
- In your DNS manager, create a CNAME for
upload.domain.com
and point that subdomain to the same server as upload.example.com
. When you're done, both upload.example.com
and upload.domain.com
both point to the same server and PHP application.
- In
www.domain.com
, embed upload.domain.com
and set document.domain="domain.com";
- In
www.example.com
, embed upload.example.com
& set document.domain="example.com";
You can see that in both cases, your website domain name matches the uploader domain name, and the document.domain property matches the domain.
When you call the $('iframe', top.document).css('border', '1px green solid');
, you won't get any permission errors.
In summary, just make sure that for whatever website you embed that uploader iframe in, that you've created a CNAME alias for that uploader that matches the website domain, and that the document.domain property is set in both the uploader and the website.
You can use the document.referrer
property in the iframe to dynamically determine the context of the parent document to determine what the domain property should be set to:
// uploader file code
// array split by period to get domain ["http://uploader", "example", "com/iframe/uploadFile", "php"]
var domainSplit = document.referrer.split(".");
// the 2nd place in the array is the domain. You may need to improve this for deeper subdomains
document.domain = domainSplit[1];
NOTE: I'm assuming you're using Apache and PHP. If so, you can create ServerAlias entries for all your upload.XYZ.com
domains. If you're using another server, most of them have some method of setting a ServerAlias.