On Sun, Jun 15, 2014 at 12:41 PM, <[email protected]> wrote: > In my app I want to use caja to display untrusted user code inside a div. > The code need to load images and fonts dynamically and to include js using > dynamic script tags. > All assets will be hosted on the same domain as the host page. > > Are there instructions how to host caja on my server? > What javascript files are needed and where to get the latest version? >
Unfortunately, we haven't actually got those instructions. This is why I didn't get around to replying sooner: I wanted to make some better documentation to give you (but I haven't found the time to do that this week). The situation was different with older versions which had heavy server components; it made more sense to take the whole lump and host that, and integration was generally nontrivial. Briefly, here's what you need now for basic functionality: 1. run the build command 'ant playground'. This will do more than you need but get the files in a convenient spot. 2. Take the following files from the directory ant-war/, where XXXX is the current version number: caja.js caja-minified.js XXXX/ses-single-frame.js XXXX/ses-single-frame.opt.js XXXX/utility-frame.js XXXX/utility-frame.opt.js Put those on your server anywhere you like, and the URL to that directory as the "cajaServer" argument to the caja.initialize() call. (Whether the minified "opt" files or the original ones are used is determined by the "debug" argument.) Do I need to use es5Mode:true? > No, but we are deprecating and removing the alternatives, so specifying it now will ensure you don't rely on the behavior of no-longer-supported modes. (If you get the code from svn trunk, you will get an ES5-mode-only version. If you get branches/es53/ instead, you get the one with ES5/3 mode and the server-side functions, which we do not recommend you use.) > What are the supported browsers in serverless mode? > Anything which supports ECMAScript 5 sufficiently correctly, which is at least current versions of Chrome, Firefox, and Safari, and Internet Explorer 11. (That's off the top of my head and might not be exactly right.) > Is it possible to use eval in the guest? > Yes, but depending on what form you use, eval'd code might not see the environment exactly as it would under the non-Caja case. -- --- You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
