JIRA in IFrame portlet - javascript doesn't work

[Carleen Dickerson, modificado hace 10 años.]

Hello - I'm attempting to embed a JIRA application into Liferay as an IFrame portlet. I can successfully navigate to the JIRA site and login, but after that none of the Javascript elements work. So I can't use any of the drop-down menus, and even the JIRA fields themselves don't display properly.

I should also mention that the Liferay & JIRA apps are being hosted by the same Tomcat server.

Can anyone think of a reason this would be happening?

Thanks!
Carleen

EDIT: Upon finally running Firebug I see I'm getting the following error: "Permission denied to access property BLAH". Why would this happen when Liferay and JIRA are being hosted from the same server??

[James Falkner, modificado hace 10 años.]

James Harrison Schueler:

Hello Carleen,

That error is usually caused by cross-domain security features for javascript built into most modern browsers. You can read about it here:

http://en.wikipedia.org/wiki/Same_origin_policy

If you have full control over your JIRA instance and associated web server, you can allow its javascript to be executed in other domains using the workarounds described in the JIRA Feature Request for CORS support.

[Carleen Dickerson, modificado hace 10 años.]

Thanks for your answers. I'm learning about the issue of CORS now, but still don't know how to implement it. I have full control of the server that Liferay and JIRA reside on, but I don't know what code within each needs to be changed for CORS. Is it as simple as setting a Tomcat configuration, or do I need to modify the source code (somehow) of each application?

Thanks so much,
Carleen

[James Falkner, modificado hace 10 años.]

Carleen Dickerson:

Thanks for your answers. I'm learning about the issue of CORS now, but still don't know how to implement it. I have full control of the server that Liferay and JIRA reside on, but I don't know what code within each needs to be changed for CORS. Is it as simple as setting a Tomcat configuration, or do I need to modify the source code (somehow) of each application?

Thanks so much,
Carleen

The way I understand it, if you can get your JIRA server's HTTP responses to include

Access-Control-Allow-Origin: *

in its headers for all responses, the browser should run it. Of course, * isn't very secure, so you could tune that later. Further, I understand that JIRA itself cannot do this, which is why some people front it with Apache, to stick that header in there, or this guy used a Tomcat plugin to insert the headers.

[Carleen Dickerson, modificado hace 10 años.]

Thanks James. I'm trying the plugin you mentioned, but it doesn't seem to be doing anything. In fact, when I check Firebug for the XHR request, there isn't one at all. Does that mean that I'm really not doing XSS?? CORS only works for XHR requests, right?

Carleen