Question

Inside the iframe tag – a CGI script is called – which return’s HTML but which is not displayed. Even viewing the iframe -> view source gives nothing but empty HTML page.

While invoking the same CGI script directly from browser it works properly. It shows a simple html page with a single table.

What are all the likely issues ? Can somebody help ?

Issue in real context:
It is a reporting script from bugzilla 3.6 which is called in IFRAME which shows report properly in iframe. But the same script in bugzilla 4.0 which is called is not showing anything only in iframe.

1. I executed both scripts using wget – both gives exactly same html ( except some table fields – which cannot be an issue).
2. Direct cgi execution from browser of both scripts – and save page as html – both are same ( except some table fields – which cannot be an issue).
3. Tried debugging the cgi script – both prints almost same messages – some arguments – dumper and like …

I have no idea of what else to check, please help. Thanks.

Answer 1

I came across the same issue and found the following in the Bugzilla 4.0 release notes

Bugzilla now sends the X-Frame-Options: SAMEORIGIN header with every
page request in order to prevent “clickjacking” attacks. Note that
this prevents other domains from displaying Bugzilla in an HTML frame.

Comment out the following lines in CGI.pm to prevent Bugzilla from setting the header.

# Add X-Frame-Options header to prevent framing and subsequent
# possible clickjacking problems.
unless ($self->url_is_attachment_base) {
    unshift(@_, '-x_frame_options' => 'SAMEORIGIN');
}