[resolved] osTicket-v1.10.4 & iFrame

almassud

All,I searched all the community and found people having issues embedding OS Ticket page in an iFrame on their website and but I have not been able to find one that ends with a solution that I could use.so what I am dealing is that I have to embed the os ticket in an iFrame, but when I do so I get a blank page in chrome and in IE I get this error message: blank Any ideas on how to fix this if possible at all?Thanks in advanced

KevinTheJedi

@[deleted]

Any errors via Apache/IIS, PHP, or MySQL/MariaDB?

What about errors in the browser console?

Any of the AJAX requests getting denied?

What is your osTicket version, PHP version, MySQL/MariaDB version, and Apache/IIS version?

Cheers.

almassud

Kevin,the link I am trying to open in the iFrame works just fine in the browser.OS Ticket version: 1.10.4Apache Version 2.4.34PHP Version 7.0.31MySQL Version 5.6.39-83.1

almassud

in addition this is a test code that I am using on my cal machine, which works fine if I embed some other URL, but won't work for OSTticket page:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type" /><title>Untitled 1</title></head><body><iframe id="I1" name="I1" src="https://www.smallbusinessitoutsource.com/support/index.php" style="width: 1333px; height: 769px">Your browser does not support inline frames or is currently configured not to display inline frames.</iframe></body></html>

ntozier

Personally I dont think that you can. osTicket sends headers with every page and having it in an iframe sounds like it would break relations and bork the proper headers. Now if it were a static html page it would work fine.

almassud

What's strange is that the older version worked just fine in the same iFrame without issues for many years, but I just had to upgrade about a week ago and this has not worked since then.

ntozier

Well if there is a solution I'm sure that Kevin will find it. :)

almassud

I hope so, because I am running out of ideas :(

almassud

somebody told me that it can be in a web config file where it would have something call "configuring

X-Frame Options that can prevent iframes

/* Font Definitions */

@[deleted]

{font-family:"Cambria Math";

panose-1 4 5 3 5 4 6 3 2 4;}

@[deleted]

{font-family:"Segoe UI";

panose-1 11 5 2 4 2 4 2 2 3;}

/* Style Definitions */

p.MsoNormal, li.MsoNormal, div.MsoNormal

{margin-top;

margin-right;

margin-bottom.0pt;

margin-left;

line-height%;

font-size.0pt;

font-family:"Calibri",sans-serif;}

.MsoChpDefault

{font-family:"Calibri",sans-serif;}

.MsoPapDefault

{margin-bottom.0pt;

line-height%;}

/* Page Definitions */

@[deleted] WordSection1

{size.5in 11.0in;

margin.0in 1.0in 1.0in 1.0in;}

div.WordSection1

{page;}

I am still looking for it.

almassud

Got it:include\client\header.inc.php("X-Frame-Options: SAMEORIGIN");to X-Frame-Options: ALLOW-FROM https://www.sbitoutsource.com/the php file is header.inc.php located in include\client\line 9change X-Frame-Options: SAMEORIGIN to ALLOW-FROM https://www.sbitoutsource.com/you can also make it Allow only if you don't care who can embed your URL.Thanks Kevin for looking in to this and I hope this thread can help others.

almassud

you may also need to do the same with all 4 files:include\client\header.inc.php("X-Frame-Options: SAMEORIGIN");include\staff\header.inc.php("X-Frame-Options: SAMEORIGIN");include\staff\login.header.php("X-Frame-Options: SAMEORIGIN");setup\inc\header.inc.php:<?php header("X-Frame-Options: SAMEORIGIN"); ?>

KevinTheJedi

@[deleted]Those lines were added as a security vulnerability fix, so undoing those lines of code makes your installation vulnerable to click jacking, session jacking, etc. Cheers.

rotelocke

We had a similar issue here and left the "sameorigin" line active, but added this line below:

header("Content-Security-Policy: frame-ancestors 'self' *.mydomain.tld");

This way all modern browsers except IE will show the page properly, as long as it is embedded in the specified domain (you can also add more domains or have a non-wildcard one). With IE it throws an error but offers to open the page in a new window under the original url. So, a halfways graceful fail.
For our purposes this was a good compromise between security and convenience.