0

I have a sharepoint hosted app page.

I have a link in it. Clicking on it it should open a modal pop up whose url is the home page of the sharepoint site.

I am able to open a modal pop up window but it is not showing any content of any external site. I tried the url as "http://www.google.com/", still the modal pop up window was blank. I have used the code :

<script type="text/javascript" >
    function openDialog(strPageURL) 
      {
        var options = {
            url: strPageURL,
            showMaximized: true,
            width: 800,
            height: 500,
            title: "Title of Dialog"
        };
        SP.SOD.execute('sp.ui.dialog.js', 'SP.UI.ModalDialog.showModalDialog', options);
        SP.UI.ModalDialog.showModalDialog(options);
    }
</script>


 <a onclick='javascript:openDialog("http://www.google.com");javascript:return false;' href="#" target=_self> Click to Open</a>

Any idea why the content of the modal is null or displaying null?

  • maybe the problem is because you trying to show a content that come through out of your domain – Salvatore Di Fazio May 23 '13 at 8:57
  • Thanks Salvatore Di Fazio Is there any work around to show content out of the domain? – Sushri May 23 '13 at 9:37
2

This is probably due to Cross Site scripting. This is not allowed, but there are som workarounds.

This MSDN thread has some suggestions

like:

<a href="JavaScript:var options=SP.UI.$create_DialogOptions();
 options.url='http://webapp1/Pages/publishingPage.aspx?isdlg=1';
 options.width = 800;
 options.height = 600;
 options.title = 'A working and simple popup';
 void(SP.UI.ModalDialog.showModalDialog(options))">
 <img src="http://webapp1/Style Library/Images/icon.png" border="0" alt="A working and simple popup" />
</a>

that maybee can work.

But basically this is a security feature for stopping "click jacking" and other hacks with javascript.

Here is an Microsoft code demo outlining the steps to retreive data from a webservice witch is not in the same domain as the executing javascript: http://code.msdn.microsoft.com/SharePoint-2013-Get-data-705bdcd5/sourcecode?fileId=67632&pathId=1102161389

Perhaps it can get you in the right direction

  • Thanks Robert for your help. I tried you code but it is also not working. Same blank modal pop up is opening. Any other workaround? – Sushri May 23 '13 at 9:42
  • Added a link to a code example from msdn, but basically search the web for "sharepoint app cross site" and look out for some code that suits your scenario. – Robert Lindgren May 23 '13 at 10:34
  • It's not cross site scripting, as you are not doing any scripting to or with the framed window apart from opening it. It's the X-Frame-Options response header coming back. See my answer. – flayman Feb 2 '18 at 11:05
0

The reason this doesn't work for the specific URL of http://www.google.com is that their web server returns the X-Frame-Options header in the response with a value of "SAMEORIGIN".

HTTP/1.1 302 Found
Location: https://www.google.co.uk/?gws_rd=cr&dcr=0&ei=h0F0WoDbNImTsAH1xb-ADQ
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 02 Feb 2018 10:46:31 GMT
Server: gws
Content-Length: 272
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Set-Cookie: OTZ=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: SIDCC=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=www.google.com
Set-Cookie: OTZ=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: SIDCC=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com
Set-Cookie: OTZ=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: SIDCC=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=google.com
Set-Cookie: OTZ=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Set-Cookie: SIDCC=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.google.com
Alt-Svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"

There's nothing you can do about this. It is entirely in the web host's control. Other sites that don't return this header should still work, though functionality may be limited. For example, try the URL http://w3c.org.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.