- From: Boris Zbarsky <bzbarsky@MIT.EDU>
- Date: Mon, 18 Aug 2008 08:57:51 -0400
- To: Ory Segal <orysegal@gmail.com>
- CC: public-html@w3.org
Ory Segal wrote: > As my previous email mentioned, the child cannot set/get any objects on > the parent, but it can still query for their existence, which means that: > > if ( parent.someObject ) > > will still return TRUE/FALSE. As it happens, the child _can_ in fact get a property off the parent window if that property is another frame. At least in some UAs. That seems like a security bug; I wonder whether it can be fixed without breaking the web... -Boris
Received on Monday, 18 August 2008 12:58:34 UTC