Hi guys,

I'm not a CB user myself as I've never had a need, however, there is a lot of people who want to use my administrator template that use CB who are unable to due to a "security feature" where iframes are not allowed and gives this error: "Iframes not allowed, could be hack attempt..., sorry!"

Is there anyway the CB dev team could take into account the host of the parent page before blocking the page from being displayed within an iframe? The link to the latest version of the admin template is below. I would like CB users to have the freedom to use the template, but apart from me patching your code (which isn't the best way to go, as it would probably break on updates) my hands are tied.

udjamaflip.com/joomla-jquery-template/56...-admin-template.html

Any advice on the issue would be appreciated. I am trying to get this template in Joomla core build for 1.7 but without CB's cooperation this won't happen due to unusability.

The javascript code for that is in admin.comprofiler.html.php lines 21-23.

If you have a secure alternative code suggestion, which works and is tested in all current browsers (FF, safari, opera, ie7 included for backend access), contributions are welcome in here

The reason to jump the admin area out of any iframe is that it is an added security measure against sophisticated XSS attacks.

You have a very cool template btw. Didn't think of that issue when i saw it.

I can not find it in CB 1.3


Where can i find it so i can use this template?

Greetze Pascal

mrhypefm wrote:

Please review the comments on the users site concerning that template. Feedback has been provided via Comments on how to resolve your issue. I don't recommend the iFrame usage for security reasons, but you're free to adjust the core as necessary.

If you've a better suggestion for a checking mechanism we'd be glad to review for implementation that is safe with internal iframes.

Post edited by: krileon, at: 2010/12/06 17:24