When the administrative overlay is enabled, the traversal links do not function.

Since they are administrative links, they are captured by the overlay, where they naturally run into all kinds of problems.

They don't make sense to open in the overlay anyway... so we can simply add the class 'overlay-exclude' to each menu item.

CommentFileSizeAuthor
#2 domain_traversal-n2837903-1-no_overlay.patch447 bytesmw4ll4c3

Comments

mw4ll4c3 created an issue. See original summary.

mw4ll4c3’s picture

mw4ll4c3 commented
StatusFileSize
new domain_traversal-n2837903-1-no_overlay.patch447 bytes
mw4ll4c3’s picture

mw4ll4c3 commented
Status: Active » Needs review

  • SpadXIII committed e2d7241 on 7.x-1.x 
    Issue #2837903 by mw4ll4c3: Traversal links are broken by administrative...
spadxiii’s picture

spadxiii commented
Status: Needs review » Fixed

Unfortunately, only adding the 'overlay-exclude' class to the links did not work for me.

Since drupal 7.50, there is an X-Frame-Options header, so javascript can't redirect the parent, outside the overlay-iframe.

My solution: break out of the overlay with a redirect to the domain-traversal link and let that redirect to the other domain.

mw4ll4c3’s picture

mw4ll4c3 commented

Thank you for the quick response and commit!

"javascript can't redirect the parent, outside the overlay-iframe."

So for now, should we just add 'overlay-exclude' to the admin/domain-traversal parent link, too? I will probably need to build that version anyway, when I do core updates... will post that follow-up patch if it will be useful to you or others.

spadxiii’s picture

spadxiii commented

I think the commit fixed the issue in a different way: it breaks out of the overlay-iframe and tries to traverse to the other domain again.

But it might be better to just disable overlay completely :)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.