Custom URL extension issue on cross-domain where application is hosted outside CME to populate field

Question

I have a requirement to use a custom URL popup to populate a field in the Component window in addition to the field that is being called by the custom URL.

I have gone through the following question which is similar to my requirement: Custom URL Manipulation of Multiple Fields

But In my case the window.dialogArguments is always undefined.

For additional information, we have hosted the custom URL application on a different server than the CM server. Are there any ways to get the fields other than window.dialogArguments?

Answer 1

You didn't mention the version of your CMS, so I'll assume SDL web 8.5 for now. When following the documentation (https://docs.sdl.com/LiveContent/content/en-US/SDL%20Web-v5/GUID-09AB9E31-DAA9-4032-813F-540DAF91812E), you will see that your Custom URL application will need to load a script from the CME:

<script type="text/javascript" language="javascript" src="/WebUI/Core/Controls/Popup/PopupInit.js"></script>

For this to work in current browsers I think you are always bound to the cross-site scripting (XSS) rules of that browser, which would limit you basically to using the same domain as the one the CMS is on I'm afraid.

Years ago this used to be more flexible, but with the extensive exploits around cross-site scripting vulnerabilities, current browsers limit your abilities there.