PDA

View Full Version : Cross-Domain Script Workaround



trippin
01-16-2007, 05:56 AM
I recently learned that it is not possible to access the html from another window or frame from another domain. I am making a script to determine if yahoo is logged on or not and have exhausted all other possiblities.

I was wondering if it was possible to store a script on Geocities which will then have the ability to read html from another page on the same domain.
The script could use ajax or form POST to send the desired html content to an external domain.

Is this logical/possible???

BLiZZaRD
01-16-2007, 06:04 AM
What do you mean by "if Yahoo is logged on or not"? I am not sure I follow exactly what you are after.

trippin
01-16-2007, 06:31 AM
Heres my previous post: http://www.dynamicdrive.com/forums/showthread.php?t=16522

I am trying to determine the logon status of a yahoo id by looking for certain text in yahoo/geocities page.

BLiZZaRD
01-16-2007, 06:51 AM
Ahh.. in that case, I will say no it is not possible. Yahoo is checking the status of their own log ins based on their server. That information is most likely parsed server side with some PHP/MySQL mixture. You would need admin status to be able to get the information from their server.

The best you could hope for (and this would also be near impossible) is to link your Yahoo messenger buddy list to the script and check if your own buddies were online.

trippin
01-16-2007, 07:11 AM
I know I can't read login status directly through yahoo. I also know that I can't decrypt the yahoo cookie and gather the info that way. My method is completely different.
Example: If you are logged on to yahoo network (not Y!Mess.) and you visitied any page in the yahoo or geocities net work you would see this text at the top of the page..

Welcome, screen_name1111
[Sign out, My account]

I want to determine if this text is there and what screenname it says. That will tell me if a user is logged in and what user it is. I know how to copy the html from a certain element from one page to another if they are on the same domain. So, I got the idea of putting the page containing the script on the geocities domain therefore copying html from geocities.com loaded in iframe and writing to parent page. The data could then be SENT to another domain.

I hope this further clarification is useful.
All help is appreciated.

BLiZZaRD
01-16-2007, 07:21 AM
That's just it, either messenger or not, the method is the same, the only way to get what you are after is to hope Yahoo uses a plain HTML log in script, which they do not. That message you are seeing is displayed by PHP. Which runs on the server, not the browser.

it would be something like:



if {$user is logged {
display $login;
}

else{ display $notlogged;
}
}


Obviously this is not a working script...

The idea is that you would need to have access to the php files that tell the script what the variable are, and copy those, THEN be able to access the SQL database and run the same check their script does (the if user is logged part)

So basically, according to the browser "that text" is always displayed, just exactly what that text says changes.

Does that make sense?

trippin
01-16-2007, 07:57 AM
I don't think you are catchin my drift..

The Welcome text is only displayed on yahoo pages after one is logged in. These pages read from the cookie left by yahoo at login and display the screenname on the page.

If the following script were on the geocities domain (i.e. http://geocities.com/screenname38272/index.htm) and loaded geocities in an iframe it could then access the html inside the iframe.. right?

//The welcome text is in <div id="welcome"> on geocities.com so..


html>
<head>
<script type="text/javascript">
function copyInnerHTML()
{
document.write(window.frames.zzz.getElementById("welcome").innerHTML);
}
</script>
</head>
<body>
<iframe name="zzz" src="http://geocities.com"></iframe>
<br /><br>
<input type="button" onclick=copyInnerHTML() value="Logged In ScreenName?" />

</body>
</html>

BLiZZaRD
01-16-2007, 07:30 PM
Okay, I see. Theoretically yes. but there is something about your code... I don't know what at the moment, but you are missing something.

I will try to think of what and see what I can come up with.

trippin
01-16-2007, 11:55 PM
Yea I was hoping this way would work since It is now on the same domain but the script still doesn't work for some reason.

BLiZZaRD
01-17-2007, 02:42 AM
Something because it is a div inside a div inside a div. I am not sure how to fix it though.

You have 2 other elements to get through "geohead" and "rightside"

trippin
01-17-2007, 08:34 PM
I changed the code to access the inner divs but to no avail.. I did some reading and found out that using IE a div can be called no matter how many other elements it is contained within. IE is the only browser I am worried about being compatible with at the moment.


<html>
<head>
<script type="text/javascript">
function copyInnerHTML()
{
ifrm = document.zzz
div1 = ifrm.getelementbyid("geohead")
div2 = ifrm.getelementbyid("rightside")
div3 = ifrm.getelementbyid("welcome")
info = div1.div2.div3.innerHTML
alert(info);
}
</script>
</head>
<body>


<iframe name="zzz" src="http://geocities.yahoo.com/gcp/"></iframe>
<br>
<input type="button" onclick=copyInnerHTML() value="Logged In ScreenName?" />

</body>
</html>

After clicking the button I get error:
Line:9 Char:1
Error: Object doesn't support this property or method

Still unsuccessful, but maybe we're getting closer? lol