FCKeditor JavaScript API throws "Security error" code: "1000" when I attempt SetHTML()

Question

After opening a webpage with exatly one FCKeditor window in it, I get the instance:

i = FCKeditorAPI.GetInstance( "txtText" )

This works. I am also allowed:

i.GetHTML() #=> <div class=".... etc., correct output

But when trying

i.SetHTML( "<h1>Quux</h1>" )

I get:

[Exception... "Security error" code: "1000" nsresult: "0x805303e8 (NS_ERROR_DOM_... etc. ]

I have an uncertain feeling, that in past, I was able to change the FCKeditor window contents with SetHTML(), but I'm not completely sure. What to do?

In response to the comment, my HTML is

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="cs" lang="cs">

<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1250" />
<meta http-equiv="Content-language" content="cs" />
<meta http-equiv="expires" content="-1" />
<meta http-equiv="pragma" content="no-cache" />
<meta http-equiv="cache-control" content="private" />
<title>Foo | Bar | WebMaker | FOO.CZ</title>
<style type="text/css" media="screen">/*<![CDATA[*/@import url(http://webmaker.ooo.cz/_design/style.css);/*]]>*/</style>
<script type="text/javascript" src="http://webmaker.ooo.cz/common.js"></script>
</head>

<body>
<div id="header">
        <span><a href="http://webmaker.ooo.cz/logout.aspx">Logout</strong></span>
</div>
    <div id="main">

        <div id="content">
            <div id="tabmenu">

            </div><!-- /tabmenu -->
            <dif id="tabcontent">
              <form name="_ctl2" method="post" action="detail.aspx?article=14599" id="_ctl2">
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE"     value="/wEPDwULLTE2MTEzz0iZG9.....reallllly..looong...strin......6qKb5or30J5DCLKTCaFR/xc8TPHb9A=" />

<script type="text/javascript">
  <!--
      var theForm = document.forms['_ctl2'];
      if (!theForm) {
          theForm = document._ctl2;
      }
      function __doPostBack(eventTarget, eventArgument) {
          if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
              theForm.__EVENTTARGET.value = eventTarget;
              theForm.__EVENTARGUMENT.value = eventArgument;
              theForm.submit();
          }
      }
   // -->
</script>

<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/wEWEQ...vsyXR4=" />
    <div class="data">
    <fieldset>
<legend>Text článku</legend>

<div><input type="hidden" id="txtText" name="txtText" value="FCK editor window contents here." /><input type="hidden" id="txtText___Config" value="HtmlEncodeOutput=true" /><iframe id="txtText___Frame" src="http://webmaker.ooo.cz/_wysiwyg/editor/fckeditor.html?InstanceName=txtText&amp;Toolbar=WebMaker" width="100%" height="400px" frameborder="no" scrolling="no"></iframe></div>  
<input type="button" onclick="GetWordsCount('txtText___Frame')" value="Zobrazit počet slov v článku" />
    </fieldset>

    <!-- There are some more fieldsets here and a submit button. -->

                  </div><!-- .data -->
              </form>
            </div><!-- tabcontent -->
</div><!-- /main -->
</body>
</html>

You'll have to post your html here, could be any number of things, including your javascript includes. — Prisoner, Jun 26 '13 at 15:41
@Prisoner: Thank for your reminder, I have done so. I hope I included all the important parts of otherwise very long html page. — Boris Stitnicky, Jun 26 '13 at 18:00
The HTML you are injecting is malformed:
... Try with
...
. Hope it helps! — opalenzuela, Jun 26 '13 at 15:36

score 1 · Answer 1 · answered Jun 26 '13 at 22:09

1

Pretty sure this is some cross domain issue where you probably think you're running on the same domain but actually are not. I would have to inspect the actual page this runs on to really be able to help you out, but try loading all the relevant fckeditor files using relative file paths (optionally from the root) and never include the actual domain, that will prevent a lot of trouble in general (what for example otherwise may happen is you being on example.com but loading files from www.example.com or similar problems).

The odd thing is that you shouldn't be able to read files then either, but the triggered error is about unpriviliged actions which are nearly always cross domain issues (or some very tricky cross script context issues, but those are mostly only relevant if you develop addons).

answered Jun 26 '13 at 22:09

David Mulder

26,123
9
51
114

Take a look, this is what happens to me when, in Mozilla (Iceweasel) I open `Tools/WebDeveloper/WebConsole`. When I control the FCKeditor through Selenium (Iceweasel again), on the same workstation, the code in the OP runs without problems. Tell me what JavaScript command do I have to type in the Web Console to explain it that I am I and make the Security Error go away. – Boris Stitnicky Jun 26 '13 at 22:37
So this is one of those crazy script context issues :O . I am no expert in them at all (though I have worked around one or two in the past)... first of all check whether it does work in firebug, wouldn't be surprised if that's the case. If it is then just use firebug for the time being and report it to mozilla... if it doesn't work in firebug either I will propose some more exotic solutions O:) – David Mulder Jun 27 '13 at 13:49
I have worked the issue around -- in Selenium, where I need it to work, it works. Thank you and everyone else for your help. – Boris Stitnicky Jul 26 '13 at 02:14

score 1 · Answer 2 · answered Jul 02 '13 at 17:06

1

If your javascript is coming from "http://webmaker.ooo.cz/...", then it's possible you're getting a domain issue if you're browsing the website under a different subdomain than the javascript is being pulled from. I'm not sure of a fix, and I'm not sure that's necessarily what's wrong. Just a possibility. I'd suggest trying to put the javascript you're using in the page with the html just to make sure the code itself actually works.

answered Jul 02 '13 at 17:06

Samuel Reid

1,756
12
22

No, that's not it, but +1 anyway for taking time to read and answer. – Boris Stitnicky Jul 26 '13 at 02:15

James Holderness · Accepted Answer · 2013-07-02T23:25:07.930

FCKeditor's SetHTML method relies on a document.write call to replace the content in the edit control. Unfortunately document.write does not work from within the Web Console on Firefox.

This is a known bug: Using document.write inside Scratchpad window brings up 'Security error undefined' in Web Console

I know that error says Scratchpad and the error message is different but it's the same problem. Note this comment from David Chan (Mozilla Security Researcher):

This appears to be another bug from running WebConsole / ScratchPad in a sandbox.

The reason you probably remember being able to do this in the past is because it works in FireBug, and it works in Chrome. You've probably used one of those environments in the past when working with a FCKeditor control.

Thanks James, that's an eye opener. – Boris Stitnicky Jul 26 '13 at 02:16 — Boris Stitnicky, Jul 26 '13 at 02:16

FCKeditor JavaScript API throws "Security error" code: "1000" when I attempt SetHTML()

... Try with

...

3 Answers3

Linked