1. view embedded Nabble content (
example)
2. log in to Nabble
3. from the
Options menu,
Subscribe to this topic= Bug =
4. despite the user being logged in, the user is
forced to log in again 5. subscription fails (is impossible).
Highlight from
WebKit nightly error console:
> Unsafe JavaScript attempt to access frame with URL … from frame with URL … . Domains, protocols and ports must match.
= Keywords =
* XSS
* cross-site scripting
This is reminiscent of
WebKit bug 20507, which originated as
plone.org ticket 919.