Link to home
Start Free TrialLog in
Avatar of ppashin
ppashin

asked on

Overriding location.replace in FireFox

I am trying to override location.replace  = function() {...} and it works for IE, but FF ignores this override.

In general i am trying to prevent location.replace to happen in an iframe to avoid iframe-breaking behavior.
location.replace = new Function("return false");

Open in new window

Avatar of Michel Plungjan
Michel Plungjan
Flag of Denmark image

Can you tell us a good reason to break a frame breaking script, please? If your reason is good enough, perhaps we can help you anyway.
If not I see this as you needing our help in forcing people's websites to STAY inside your site even though they EXPLICITLY do not want that? Sounds like a copyright infringement right there...

I am actually amazed it even works in IE since you override another site's behaviour. It should be registered as a security violation at Microsoft.


Avatar of ppashin
ppashin

ASKER

i am building an online browser
*** site removed as requested ***

Open in new window

location.replace is window specific - are you telling me that IE will allow you to override the top.location.replace and that will stop iframes from breaking out of frames?
And what do you do with
<a href="bla.html" target="_top">Break out of frames</a>

and what do you do with

window.open(url,"_top")

and what do you do with

window.open(url,"_blank")
which will open in a new tab ?

I get a "Firefox prevented this url from asking you to install software"
Is that from the replace thing?
Avatar of ppashin

ASKER

Yes, we have a FF and IE plugins that prevent <a href="bla.html" target="_top">Break out of frames</a>

by modifying contents of the site. I wasn't aware of other methods and will need a work around for them as well
So have the plugin (or a server proxy?) detect and remove the .replace too
Avatar of ppashin

ASKER

by plugin i mean FF extension and IE BHO. no proxies as we can get access to the document using pluggins.

Can you give me a code sample for FF extension on how would i remove .replace.
No. Sorry. Never made any extensions.
If you can modify the html on the fly, just add
<script>
location.replace=function() {return ""}
</script>

IN the page you are loading

Avatar of ppashin

ASKER

I've tried replacing location.replace with another function but it still retains its original in firefox. Do you know of a method to retrieve scripts from a page, including those that are taken from another src, and modify its contents?
If you override location.replace anywhere on page page, it will not work regardless from where the call to location.replace is coming from.
So location.replace is read only in FF
try

document.body.parentNode.innerHTML=document.body.parentNode.innerHTML.replace(/top.location.replace/g,'self.location.replace;')

in a script on the page
Avatar of ppashin

ASKER

That works well unless the script is from an external source. How can I replace those scripts as well?
Dunno. I would use a proxy for all - no need for further extensions or IE scripts
Avatar of ppashin

ASKER

External source meaning <script src=/js/iframe_breaking_script.js ></script>
ASKER CERTIFIED SOLUTION
Avatar of Michel Plungjan
Michel Plungjan
Flag of Denmark image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Answers given, confidential info can be removed if necessary
Avatar of ppashin

ASKER

I was looking for an answer concerning no proxies. If i were to use a proxy, i wouldn't post this question.

I insist that you remove this conversation from the web.
Exactly.

I tried my best to help you with suggestions and workarounds.

The ultimate answer is:
1. location.replace is read-only in firefox - that is the answer to the original question
2. location.replace is only one of MANY ways to break out of frames
3. If site owners want not to be framed, you should respect that - if you get permission, you can proxy your way out of most of the frame breakers.

My answers and time is freely given, but just because you do not like the answers does not mean you have to shoot the messenger.

There is enough information for you in this question to award an "A" grade and pose a new question about how to write a plugin.

Thanks

Michel
PS: I have removed or deleted all references to the site you are building.
Avatar of ppashin

ASKER

So if i close the questions, will you remove this conversation from the web?