[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-25 Thread Chris Chabot
You should be able to reuse the makeRequest / Proxy classes (and their RemoteContent fetcher dependencies) from shindig, you can find them in shindig/php/src/gadgets/*{Proxy,Request}*.php. Either straight up extracting those classes and intergrating them in your env, or using them to reverse engine

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-25 Thread Andi
Hey Chris, i'm currently experimenting around with that. I just created s imple php proxy and changed JsonRpcContainer.sendRequest that it use makeRequest instead of makeNonProxiedRequest. It seems to work somehow. The data is passed through as JSON and i also get JSON data back but it seems i ha

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-25 Thread Chris Chabot
On Thu, Jun 25, 2009 at 2:45 PM, Andi wrote: > > Hi Chris, > > thanks for your answer again, but unfortunatly i can't use Gadgets. I > don't want to support 2 different systems > of widgets and Gadgets. > > So i still have to find a way to solve the XSS problem with directly > using the opensocia

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-25 Thread Andi
Hi Chris, thanks for your answer again, but unfortunatly i can't use Gadgets. I don't want to support 2 different systems of widgets and Gadgets. So i still have to find a way to solve the XSS problem with directly using the opensocial API without gadget support. regards Andi On Jun 24, 3:52 p

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-24 Thread Chris Chabot
Ah I was afraid you were trying to do that. In the interest of saving you a lot of time and headaches: Don't... really, just don't. All the features JS code has been made for use through shindig and not through direct inclusion, it depends on lots of security, configuration, proxy and rpc data an

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-24 Thread Andi
Hey Chris, thanks for your fast answer see my comments below, hope you can help me .-) > > Are you manually including shindig's javascript code from your gadget, or > what javascript code is coming from where? Exactly. the current shindig Service is running locally for the moment at http:/

[OpenSocial] Re: XSS Solution without Gadgets?

2009-06-24 Thread Chris Chabot
Hey Andi, I'm not entirely sure what exactly you're trying to do and what exact error you are running into, could you possibly please provide us with a bit more info and/or code snippets of what you are doing? :) Are you manually including shindig's javascript code from your gadget, or what javas