【发布时间】:2013-03-17 04:02:55
【问题描述】:
我在使用 FineUploader 在隐藏 iframe(即 IE 9、8)内进行跨域 (CORS) 提交时遇到问题。对于每个跨域上传请求,图片上传成功,但显示错误消息,IE bugger 说明:
No valid message received from loaded iframe for file id 1
现在详细来说,他们的blog 说:
所有跨域 iframe 发起的响应都必须以上面的脚本标签结尾,并且有效的 JSON 部分必须包含关联文件的 UUID。请注意,您必须在可访问的服务器上托管 iframe.xss.response.js 文件并相应地在标记中引用它。当您的响应内容返回到 Fine Uploader 跟踪的 iframe 时,上述脚本标签导入的相关 javascript 文件将被执行,并将您响应的 JSON 部分通过 window.postMessage 传递给上传者。
好的,所以我实现如下:
if(!isset($_SERVER['HTTP_X_REQUESTED_WITH'])
|| (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH']!="XMLHttpRequest")){{
header("Content-Type: text/html");
$result['uuid'] = $uploader->gen_uuid();
echo json_encode($result);
echo "<script src='http://example.com/js/iframe.xss.response-3.3.0.js'></script>";
}
现在,Fiddler 说响应如下:
HTTP/1.1 200 OK
Date: Sun, 17 Mar 2013 03:26:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=VJ3AgTRnMtjAqbxizfXBN3; path=/
Vary: Accept-Encoding
Content-Length: 203
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html
{"success":true,"uploadName":"_73d05d51b4ab624e3260ef0b289a60bc_NMS_0785.JPG","uuid":"749174c7-e29c-485f-9f6d-cc18d4b5d0fd"}<script src='http://example.com/js/iframe.xss.response-3.3.0.js'></script>
IE 调试器说:
[FineUploader] Processing 1 files or inputs...
[FineUploader] Sending upload request for 1
[FineUploader] Received iframe load event for CORS upload request (file id 1)
[FineUploader] Received the following window message: '{"success":true,"uploadName":"_73d05d51b4ab624e3260ef0b289a60bc_NMS_0785.JPG","uuid":"749174c7-e29c-485f-9f6d-cc18d4b5d0fd"}'
[FineUploader] Received the following window message: '{"success":true,"uploadName":"_73d05d51b4ab624e3260ef0b289a60bc_NMS_0785.JPG","uuid":"749174c7-e29c-485f-9f6d-cc18d4b5d0fd"}'
[FineUploader] No valid message received from loaded iframe for file id 1
[FineUploader] iframe loaded
有人知道可能出了什么问题吗?
【问题讨论】:
-
我正在尝试填补 Fineuploader 开发人员的职位,直到他从假期回来。您确定 JS 文件从
http://example.com/js/iframe.xss.response-3.3.0.js正确提供吗? (我假设example.com是占位符文本。)
标签: cors fine-uploader