Cross Server scripting in DCTs

Hi,

I have an application in which I am attempting a callout to a ColdFusion template (popup) where the user will select one or more items. Those items will be used to populate the dct field with the list of items. The DCT and the CF Template reside on different servers within the same domain. I can get to the cf template successfully. The code runs and then fails when I attempt to set the dcts field value - I receive "Permission denied" in the javascript within the CF template. Researching, I have found a possible solution in setting document.domain on both sides using:

script
document.domain = "mydomain.org";
script

With this on both sides, I receive "Permission Denied" when the dct is loading.

If I remove the above lines from the dct, the form loads, but the "permission denied" occurs on the other server when attempting to access the field value from the dct. Can the problem be the way I'm addressing the field:

"window.opener.top._dcWin.formframe.document.dcreditForm.article.keywordlist.value=document.metadataForm.selectedMetadata.value;"

I got this portion from the form variables that are set by callout:

iw_form_name = "window.opener.top._dcWin.formframe.document.dcreditForm"

iw_callback_var = "article/keywordlist"

and "article/keywordlist" is the name of the field on the dct. I have tried removing article (that's the data type)...all attempts have produced the permission denied error.

Any assistance in resolving this would be greatly appreciated....

Thanks,

Craig

Find more posts tagged with

Comments

ISCBorisB

The DCT and the CF Template reside on different servers within the same domain

If not for your note above I would have said that you have a text book sample of cross-domain security Model violation. I still think that's the case.
To fight it, try to set document.domain on the CF Side only. Set it exactly like the original (and intact) DCT Form's document.domain.

If that does not help you would have to write TS CGI that can make CF Side request(s), present Window(s) to the user, etc...
and then turn around and update DCT Form Fields

Adam Stoller

"window.opener.top._dcWin.formframe.document.dcreditForm.article.keywordlist.value=document.metadataForm.selectedMetadata.value;"

Not sure about the general issue - which was already responded to, but the above is definitely not a supported method for accessing the DCT.

Also - the above appears to be related to the metadata capture DCT as opposed to a FormsPublisher DCT - the former does not [yet] support FormAPI - but as of 6.5 you need to go through some contortions to access the specific fields within the form (each field is associated with a 'property' form variable, through which you need to then access the name associated with the property to make sure you got the right field).

The closest I can find to information about this in the forums is this - I believe the other, more detailed and informative posts were in a "beta" forum which is no longer on-line.

ISCBorisB

Not sure about the general issue - which was already responded to, but the above is definitely not a supported method for accessing the DCT.

Also - the above appears to be related to the metadata capture DCT as opposed to a FormsPublisher DCT - the former does not [yet] support FormAPI - but as of 6.5 you need to go through some contortions to access the specific fields within the form (each field is associated with a 'property' form variable, through which you need to then access the name associated with the property to make sure you got the right field).

The closest I can find to information about this in the forums is this - I believe the other, more detailed and informative posts were in a "beta" forum which is no longer on-line.

It seems that the right part of this command (document.metadataForm...) belongs to the ColdFusion side of the puzzle. Hence it is not related to TS MDCT and all that.
I agree that the left part of it looks shall we say, unconventional