Recent Widgets


Register for DashboardWidgets

Recent Forums Posts

Partners


iCompositions

MacDesktops.net

RSS Showcase
RSS Comments
RSS Forums

This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies. Posted in: Widget Development

XMLHTTPRequest has stopped working

Author Message
wuf810



Joined: 27 Mar 2005
Posts: 19
Location: United Kingdom (Great Britain)

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Hi all,

Since installing the latest Tiger seed (december), my XMLHTTPRequest nolonger works in my widget.

Strange thing is that the widget functions correctly, including the request, in Safari.

Anyone else seen this or had a problem since the new seed?

Thanks, Michael.
View user's profile Send private message Widgets
wuf810



Joined: 27 Mar 2005
Posts: 19
Location: United Kingdom (Great Britain)

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Ok I'ved tried Chris O'Brien's Translate Widget which also uses the XMLHTTPRequest and it also does not work for me.

Can someone (anyone) try it with the latest seed and let me know if it works for them.

If yes I can assume the problem is with my installation. If not then at least we all know something has changed in this seed.

Look forward to hearing from you all.

Michael.
View user's profile Send private message Widgets
Chris



Joined: 27 Jan 2005
Posts: 344
Location: Durham, UK

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

It doesn't work here either. I never noticed this until you mentioned it.

I've been playing around with it trying to figure out the problem: it seems that it works OK with local files (the way Snake loads levels still works fine) but doesn't work with remote files. I'm going to keep playing around to see if there's a way round it. One noticable thing is that it goes straight to a readyState of 4. Weird...
View user's profile Send private message Send e-mail Visit poster's website AIM Address Widgets
wuf810



Joined: 27 Mar 2005
Posts: 19
Location: United Kingdom (Great Britain)

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Relieved it not just me.

Yes it is strange as all works fine from Safari...I wonder whether it is a security issue either with privileges of with XMLHTTPRequest itself. I hope they haven't implemented this (from Apples Documentation)

"Security Issues

When the XMLHttpRequest object operates within a browser, it adopts the same-domain security policies of typical JavaScript activity (sharing the same "sandbox," as it were). This has some important implications that will impact your application of this feature.

First, on most browsers supporting this functionality, the page that bears scripts accessing the object needs to be retrieved via http: protocol, meaning that you won't be able to test the pages from a local hard disk (file: protocol) without some extra security issues cropping up, especially in Mozilla and IE/Windows. In fact, Mozilla requires that you wrap access to the object inside UniversalBrowserRead security privileges. IE, on the other hand, simply displays an alert to the user that a potentially unsafe activity may be going on and offers a chance to cancel.

Second, the domain of the URL request destination must be the same as the one that serves up the page containing the script. This means, unfortunately, that client-side scripts cannot fetch web service data from other sources, and blend that data into a page. Everything must come from the same domain. Under these circumstances, you don't have to worry about security alerts frightening your users."


I may register it as a bug and hope its "fixed" for the next seed. If it remains as is thats the end of my widget!!

Michael.
View user's profile Send private message Widgets
wuf810



Joined: 27 Mar 2005
Posts: 19
Location: United Kingdom (Great Britain)

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Problem reported to Apple with following report ID 3936278.

I'll let you what if any reponse I get.

Michael.
View user's profile Send private message Widgets
Chris



Joined: 27 Jan 2005
Posts: 344
Location: Durham, UK

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Yeah, that's the way Mozilla browsers behave with XMLHttpRequest. I've never understood why just retrieving the data would be a security issue. Writing/posting data to an arbitrary server I can understand, but just using stuff readily available? Nope.

If this isn't a bug, and they have adopted the Moz way of doing (if I remember correctly, the article you quoted was refering to Moz as it was written before Safari came out) then the third type of widget (information widgets) mentioned here is now obsolete.

I fully believe this is just a bug at the moment though, as everything still works fine in Safari 2 (and the fact they mention the 3rd kind of widget).
View user's profile Send private message Send e-mail Visit poster's website AIM Address Widgets
Xia



Joined: 27 Mar 2005
Posts: 1

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

The same problem troubled me also after installing 8A323. As wuf810 mentioned, it works fine in Safari.

I noticed that the XMLHttpRequest property readyState changed from 1 to 4 in Safari (1->2->3->4). But in Dashboard, it's 1->4 without 2 and 3. And then most of the properties are undefined. This could be the problem? No idea here.

Also, it looks like if you don't let XMLHttpRequest handle the upcoming transaction asynchronously. It DOES work. (Call method open and set asyncFlag as false, set callback onreadystatechange as null). Though doing this makes the Widget useless.

BTW: The debug function refused to work, have to be tweaked also.
View user's profile Send private message Widgets
jackinloadup



Joined: 02 Feb 2005
Posts: 18

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

yeah i was noticing the same problem. i had made a webcam app that i used a bit to look at that shark tank. the one that was on steves demo. now i cant look at my sharks i hope someone finds a fix for this. athough tiger comes out in like 10 days so there is almost need

HAPPY NEW YEAR!!!!!
View user's profile Send private message Send e-mail AIM Address Widgets
Chris



Joined: 27 Jan 2005
Posts: 344
Location: Durham, UK

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Why do you think Tiger is coming out in 10 days?
View user's profile Send private message Send e-mail Visit poster's website AIM Address Widgets
jackinloadup



Joined: 02 Feb 2005
Posts: 18

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

well i think its coming out at MWSF 05 on Jan 11
View user's profile Send private message Send e-mail AIM Address Widgets
wuf810



Joined: 27 Mar 2005
Posts: 19
Location: United Kingdom (Great Britain)

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Hi guys,

I've had a response from Apple and the bug is marked as "standard behaviour".

HOWEVER the good news is that if you include the following in your plist

<key>AllowNetworkAccess</key>
<true/>

everything works again! Hadn't noticed this in the documentation so maybe it is undocumented.

When you run a widget accessing a remote site for the first time, the user is now prompted with a message saying something like 'this widget is untrusted. Continue loading, Yes or No' (very ugly message). Saying yes obviously allows the widget to load.

Hope this helps!
View user's profile Send private message Widgets
Chris



Joined: 27 Jan 2005
Posts: 344
Location: Durham, UK

Posted: Fri Dec 24, 2004 - 10:54 am    Post subject: Imported from The Dashboader Reply with quote

Ah, excellent. I hadn't noticed that either.

I must say that I'm a big fan of how Apple is handling what may be conceived as security issues now. Before, when it was just having the plugin owned by root it seemed kind of half-hearted. This way (with things being turned 'on' and 'off' in the plist) seems like it's much handier for Apple to implement things. It also means paranoid people like me can quickly check the plist to see what sort of things will be happening - "what does this game of mine sweeper need system access for?", et-cetera.

View user's profile Send private message Send e-mail Visit poster's website AIM Address Widgets
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.

 
Powered by phpBB © 2001, 2002 phpBB Group