Custom URL extension issue on cross-domain where application is hosted outside CME to populate field

Question

I have a requirement to use a custom URL popup to populate a field in the Component window in addition to the field that is being called by the custom URL.

I have gone through the following question which is similar to my requirement: Custom URL Manipulation of Multiple Fields

But In my case the window.dialogArguments is always undefined.

For additional information, we have hosted the custom URL application on a different server than the CM server. Are there any ways to get the fields other than window.dialogArguments?

Answer 1

You didn't mention the version of your CMS, so I'll assume SDL web 8.5 for now. When following the documentation (https://docs.sdl.com/LiveContent/content/en-US/SDL%20Web-v5/GUID-09AB9E31-DAA9-4032-813F-540DAF91812E), you will see that your Custom URL application will need to load a script from the CME:

<script type="text/javascript" language="javascript" src="/WebUI/Core/Controls/Popup/PopupInit.js"></script>

For this to work in current browsers I think you are always bound to the cross-site scripting (XSS) rules of that browser, which would limit you basically to using the same domain as the one the CMS is on I'm afraid.

Years ago this used to be more flexible, but with the extensive exploits around cross-site scripting vulnerabilities, current browsers limit your abilities there.

Answer 2

TL;DR: PopupInit.js requires that the custom URL is hosted on the Tridion server with same Protocol, Hostname and Port to interact via windows.dialogArguments

I had the same issue. When you look at the script in PopupInit.js, you would see a big try/catch block encapsulating the code. If you place that piece of code inline in your extension HTML without the try/catch you can see the actual error(s) when opening the popup.

The goal PopupInit script is to load objects from the window.opener to populate window.dialogArguments with the component values. In my case loading the script, console debug (via F12 key in Chrome) reported 'same-origin policy' violation. Which is not to be confused with CORS.

More information about 'same-origin policy' error: https://stackoverflow.com/questions/25098021/securityerror-blocked-a-frame-with-origin-from-accessing-a-cross-origin-frame

So, I ended up with creating a Virtual Application within IIS for hosting the Custom Url application.

Hope this helps..