Question

I have Apache set up through xampp to test a webpage to load some .php file to read a .csv file as data source to output a bar graph chart. And I encounter this error on Chrome.

Unsafe JavaScript attempt to access frame with URL file:///C:/xampp/htdocs/search/php/loader/csvFileUploader.php from frame with URL file:///C:/xampp/htdocs/search/stackedBarChart.html. Domains, protocols and ports must match.
upclick-min.js:99
i.onload_callback.i.onload_callback upclick-min.js:99
onload

I don’t think this is an iframe problem like many other posts have suggested. I tested this also through firefox, it went beyond reading the php but doesn’t load the .csv file from local directory.

Any suggestions?

<script>
        var uploaderCSV = document.getElementById('uploaderCSV');
            upclick({
                element : uploaderCSV,
                action : 'php/loader/csvFileUploader.php',
                onstart : function(filename) {
                    console.log(" -- Start upload: <" + filename + "> Here");

                },
                oncomplete : function(response_data) {
                    alert(response_data);
                    console.log("  -- CSV file to load: ", response_data);
                    var n = response_data.split("|");

                    if (n.length > 1) {
                        console.log("  >> csv file loaded at[ ", n[1], " ]");
                        loadDayLightFactor("php/loadCSV.php", "../" + n[1]);
                    }
                }
        });


</script>

and here’s the php file

<?php
// using upload at click from http://code.google.com/p/upload-at-click/
// FileData is the name for the input file

$file_result = "";
$file = $_FILES['Filedata'];

$allowedExtensions = array("csv", "txt");
$extension = end(explode(".", $file["name"]));

echo "123".$file;

?>

Answer 1

Your problem seems to be the URL you are trying to reach:

file:///C:/xampp/htdocs/search

This is not the way to develop on local environment.
try to access it through

http://localhost/search

I’m sure it will work better. detailed explanation below..

---

This is happening because of a security standard called Cross-Domain-Policy

You can not make a call (via JavaScript) to files with a URL that is different from your current URL Address.

For example:
My website’s URL is foobar.com, I’m trying to send an AJAX request to barbaz.com.

I can’t!

because it’s not my domain. I can try sending requests to barbaz.foobar.com (using some JavaScript code).

Another scenario that will show you why this is a “must have” security standard:

Lets say that I’m logged into my bank’s website using a cookie. the cookie is persistent.

I’m entering a random website X that send AJAX request to all known bank websites. If I’m still logged into my bank’s website, X website can “talk” to the bank’s website using my user, and do things that I’m not aware of.

This is a small example why this is very important.

I hope this was helpful.