Page MenuHomePhabricator

Kartographer map does not open on it.wikivoyage.org: "Blocked a frame from accessing a cross-origin frame"
Closed, DuplicatePublic

Description

In https://en.wikivoyage.org/wiki/Florence#Q191739 clicking on the blue boxed number 1, the map is correctly opened. Temporary the URL shown in the browser turn into https://en.wikivoyage.org/wiki/Florence#/maplink/9 but if ESC is pressed, the map disappear and return the URL turn back to https://en.wikivoyage.org/wiki/Florence

In https://it.wikivoyage.org/wiki/Firenze#Basilica_di_Santa_Maria_Novella clicking on the blue boxed number 1 instead of having the same behaviour, since today it generates the following error:

Uncaught DOMException: Blocked a frame with origin "https://it.wikivoyage.org" from accessing a cross-origin frame.
    at Object.OO.ui.Element.static.getDocument (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=2p8ww:164:64)
    at Object.OO.ui.Element.static.getDimensions (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=2p8ww:166:174)
    at MapDialog.OO.ui.Window.getSize (<anonymous>:29:519)
    at OoUiWindowManager.OO.ui.WindowManager.updateWindowSize (<anonymous>:25:312)
    at MapDialog.OO.ui.Window.updateSize (<anonymous>:31:763)
    at <anonymous>:33:636
    at mightThrow (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=2p8ww:49:149)
    at process (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=2p8ww:49:808)

The HTML generated looks the same. Apparently the only two differences are:

  1. on the href

it:voy: href="https://it.wikivoyage.org/wiki/Firenze#/maplink/5"
en:voy: href="#/maplink/9"
most likely this is not relevant to the current behaviour but is something that can be uniformed

  1. on the class="geo"

en:voy: the hidden span block is generated server side
it:voy: the same is generated by the local template

Regardless the bug, these two aspects should be uniformed.

I used Chrome latest version. I've tested it after a user highlighted the problem in our local "lounge". He used both Safari and Chrome.

Event Timeline

Aklapper renamed this task from Kartographer map do not open on it:voy to Kartographer map does not open on it.wikivoyage.org: "Blocked a frame from accessing a cross-origin frame".Jul 16 2020, 10:35 AM

Hi @Andyrom75, thanks for taking the time to report this! For future reference, please provide a list of steps to reproduce and please use debug=true.

  1. Go to https://it.wikivoyage.org/wiki/Firenze?debug=true#Basilica_di_Santa_Maria_Novella
  2. Click on the blue box with "1", next to Basilica di Santa Maria Novella
  3. Firefox 78 opens https://it.wikivoyage.org/wiki/Firenze?debug=true#/maplink/4 and shows a map as expected. Chromium 82 does not open anything.

Likely related to contacting maps.wikimedia.org, meta.wikimedia.org and upload.wikimedia.org servers here.

WindowManager.js:461 Uncaught DOMException: Blocked a frame with origin "https://it.wikivoyage.org" from accessing a cross-origin frame.
 at Object.OO.ui.Element.static.getDocument (https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-core.js?0abcb:868:32)
 at Object.OO.ui.Element.static.getDimensions (https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-core.js?0abcb:1029:14)
 at MapDialog.OO.ui.Window.getSize (https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-windows.js?ac497:2053:38)
 at OoUiWindowManager.OO.ui.WindowManager.updateWindowSize (https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-windows.js?ac497:1682:21)
 at MapDialog.OO.ui.Window.updateSize (https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-windows.js?ac497:2291:15)
 at https://it.wikivoyage.org/w/resources/lib/ooui/oojs-ui-windows.js?ac497:2459:7
 at mightThrow (https://it.wikivoyage.org/w/resources/lib/jquery/jquery.js?11c05:3557:29)
 at process (https://it.wikivoyage.org/w/resources/lib/jquery/jquery.js?11c05:3625:12)

This is likely due to the tools.wmflabs.org -> toolsforge.org migration (CORS is not allowed when following redirects and these have therefor become dross domain resources, that are not setup with CORS headers T254693: Same origin policy access between tools deliberately broken by toolforge.org migration).
Its' probably fixed if the urls in https://it.wikivoyage.org/wiki/MediaWiki:Kartographer.js are to be corrected to bypass the redirect

https://tools.wmflabs.org/wikivoyage/w/data/it-articles.js to
https://wikivoyage.toolforge.org/w/data/it-articles.js

This likely applies to most other wikivoyages as well.

Actually for this particular issue, it is the poimap2.php iframe inclusion, which also need its urls updated.

Pages have a link:
https://tools.wmflabs.org/wikivoyage/w/poimap2.php?lat=43.770483&lon=11.255229&zoom=15&layer=W&lang=it&name=Firenze
which get turned into:
https://wikivoyage.toolforge.org/w/poimap2.php?lat=43.770483&lon=11.255229&zoom=15&layer=W&lang=it&name=Firenze

And it's subresource:
https://wikivoyage.toolforge.org/w/lib/empty.gpx

Again, update the urls to wikivoyage.toolforge variants and this will be fixed. Specifically here: https://it.wikivoyage.org/wiki/MediaWiki:Gadget-MapFrame.js
I already fixed: https://it.wikivoyage.org/w/index.php?title=Template:PoiMap2

@TheDJ I've applied your suggested change but the issue persist.

PS In en:voy they use the script in it:voy without your change so I tend to suppose that this script is not the one that cause the problem on it:voy

@Andyrom75 you still need this one.

This is likely due to the tools.wmflabs.org -> toolsforge.org migration (CORS is not allowed when following redirects and these have therefor become dross domain resources, that are not setup with CORS headers T254693: Same origin policy access between tools deliberately broken by toolforge.org migration).
Its' probably fixed if the urls in https://it.wikivoyage.org/wiki/MediaWiki:Kartographer.js are to be corrected to bypass the redirect

https://tools.wmflabs.org/wikivoyage/w/data/it-articles.js to
https://wikivoyage.toolforge.org/w/data/it-articles.js

This likely applies to most other wikivoyages as well.

There are also older urls in:
https://it.wikivoyage.org/wiki/MediaWiki:Gadget-ImageMap.js
tools.wmflabs.org/imagemapedit/ime.js -> imagemapedit.toolforge.org/ime.js

and in https://it.wikivoyage.org/wiki/MediaWiki:Gadget-ListingEditor.js
https://tools.wmflabs.org/wikivoyage/w/geomap.php -> https://wikivoyage.toolforge.org/w/geomap.php
https://tools.wmflabs.org/geohack/geohack.php?params= -> https://geohack.toolforge.org/geohack.php?params=

@TheDJ I've applied all the suggested changes although some of them are present also in en:voy where everything works correctly.
FYI in MediaWiki:Kartographer.js there is still this link: https://tiles.wmflabs.org/hillshading/{z}/{x}/{y}.png

I've tried to purge all the changed files and a random tested article, but unfortunately I have to say that the problem persists.

PS To speed up the process, I've performed all the remaining "wmflabs->toolforge" & "tools->xtools" changes

Ah. I think I understand it. ooui does some document dom access, and it does this after the https://it.wikivoyage.org/wiki/MediaWiki:Gadget-ImageMap.js has added a frame to toolforge. That is what throws this error of:

SecurityError: Blocked a frame with origin "https://it.wikivoyage.org" from accessing a cross-origin frame. Protocols, domains, and ports must match.

Haven't completely pinpointed inside the OOUI phases which particular piece of code is triggering this however, everything is layered in promises and deferreds....

On OOUI I admit I lost you :-) But I hope you'll be able to find anything that could be fixed.

However, in the meanwhile, can Kartographer be adjusted server side to uniform the two aspects that I've highlighted in the first post?

@TheDJ just a consideration. MediaWiki:Gadget-ImageMap.js is activated only on NS:File, here below the code:

if (mw.config.get("wgNamespaceNumber")==6 && mw.config.get("wgAction")=='view') {
	mw.loader.load('//imagemapedit.toolforge.org/ime.js');
}

In any case I've change its status and it's not anymore loaded by default for any user but the issue persist, so I tend to suppose that the problem is not in that script.

With debug=on:

Uncaught DOMException: Permission denied to access property "ownerDocument" on cross-origin object Element.js:301
    getDocument Element.js:301
    getDimensions Element.js:462
    getSize Window.js:216
    updateWindowSize WindowManager.js:707
    updateSize Window.js:454
    setup Window.js:622
    jQuery 2

Related bugs: T258254 and T258256

I can reproduce with Firefox 78.0.2 and the extension Google Translator https://addons.mozilla.org/fr/firefox/addon/google-translator-webextension/ last updated on July 17, 2019 (not 2020)

With the closure of T258256 actually this bug is solved, but in the Chrome console appear this warning each time I close the map with ESC key instead of closing it clicking with the mouse on the X button:

jQuery.Deferred exception: Cannot read property 'parentMap' of null TypeError: Cannot read property 'parentMap' of null
    at <anonymous>:2:464
    at mightThrow (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=krt68:49:149)
    at process (https://it.wikivoyage.org/w/load.php?lang=it&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets%7Cjquery.ui&skin=vector&version=krt68:49:808) undefined

There's anything that can be done?

PS this occurs both on it:voy and en:voy