Skip to content

Conversation

@AidanCurrah
Copy link
Contributor

Changes needed for PR#302 on PT

event.preventDefault()

// Inform the parent page of the selected item
window.parent.postMessage(pk, '*');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

* should not be used in this case. From MDN:

Always provide a specific targetOrigin, not *, if you know where the other window's document should be located. Failing to provide a specific target discloses the data you send to any interested malicious site.

In this case it should always be the same origin - use window.location.origin instead.

pk = pk.split('/')
pk = pk[4]

// Prevent default
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment doesn't add any information - we know what event.preventDefault does, and "Prevent default" wouldn't explain it to anyone if they did not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants