I have a requirement to use a custom URL popup to populate a field in the Component window in addition to the field that is being called by the custom URL.

I have gone through the following question which is similar to my requirement: Custom URL Manipulation of Multiple Fields

But In my case the window.dialogArguments is always undefined.

For additional information, we have hosted the custom URL application on a different server than the CM server. Are there any ways to get the fields other than window.dialogArguments?

2 Answers 2


You didn't mention the version of your CMS, so I'll assume SDL web 8.5 for now. When following the documentation (https://docs.sdl.com/LiveContent/content/en-US/SDL%20Web-v5/GUID-09AB9E31-DAA9-4032-813F-540DAF91812E), you will see that your Custom URL application will need to load a script from the CME:

<script type="text/javascript" language="javascript" src="/WebUI/Core/Controls/Popup/PopupInit.js"></script>

For this to work in current browsers I think you are always bound to the cross-site scripting (XSS) rules of that browser, which would limit you basically to using the same domain as the one the CMS is on I'm afraid.

Years ago this used to be more flexible, but with the extensive exploits around cross-site scripting vulnerabilities, current browsers limit your abilities there.

  • Thanks @Bart for answer, I have added <script type="text/javascript" language="javascript" src="cmsurl/WebUI/Core/Controls/Popup/PopupInit.js"></…> to access popupinit.js and it is accessible but custom url application is getting window.dialogArguments always undefined Jul 25, 2018 at 5:28
  • Bart - would setting up CORS work to get around the same domain problem?
    – Neil
    Jul 25, 2018 at 6:58

TL;DR: PopupInit.js requires that the custom URL is hosted on the Tridion server with same Protocol, Hostname and Port to interact via windows.dialogArguments

I had the same issue. When you look at the script in PopupInit.js, you would see a big try/catch block encapsulating the code. If you place that piece of code inline in your extension HTML without the try/catch you can see the actual error(s) when opening the popup.

The goal PopupInit script is to load objects from the window.opener to populate window.dialogArguments with the component values. In my case loading the script, console debug (via F12 key in Chrome) reported 'same-origin policy' violation. Which is not to be confused with CORS.

More information about 'same-origin policy' error: https://stackoverflow.com/questions/25098021/securityerror-blocked-a-frame-with-origin-from-accessing-a-cross-origin-frame

So, I ended up with creating a Virtual Application within IIS for hosting the Custom Url application.

Hope this helps..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.