[Bug]: API requests send incorrect TabId in pop-ups

[DanielBolef]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

When opening another page in a pop-up via dnnModal.show, requests from modules on that page get the parent page TabId put in the request headers. This causes problems for APIs that use that, as that module may not exist on the parent page. The TabId of the page open in the pop-up should be sent instead.

Steps to reproduce?

1. Enable pop-ups (It's disabled by default on 10.X.X)
2. Add the Resource Manager module to a page
3. On another page, add a module that opens the first page via dnnModal.show. An example of this would be an HTML module with this HTML:<p><a href="/Test" onclick="return dnnModal.show('/Test?popUp=true',true,550,950,false)">Test Pop-up</a></p>
4. Open the pop-up

Current Behavior

The incorrect TabId is sent in the request headers; parent page instead of pop-up page. In the example given above, Resource Manager is unable to get its settings and folder information. It may also trigger browser alerts related to the info the API calls were supposed to get.

Expected Behavior

API calls from modules on the pop-up page should have the correct TabId in the request headers. In the example above, Resource Manager should load as expected.

Relevant log output

{"Message":"Specified module instance does not exist."}

Anything else?

No response

Affected Versions

10.2.3 (latest release)

What browsers are you seeing the problem on?

Chrome

Code of Conduct

• I agree to follow this project's Code of Conduct

[valadas]

I would think this is by design...

[mitchelsellers]

When you open a piece of content within a modal, you are still in the overall context of the same page, therefore, things that have a global scope, such as Tab information etc, are going to remain the same as the surrounding content.

The only real way "around" this would be for the items to be truely iframed into a sandbox, and I don't believe that is how the modal process works.

[bdukes]

I would think Resource Manager should work just as well in a pop-up/iframe as not.

The issue is that the dnnServicesFramework code used by dnn-elements is designed for the Persona Bar, and always gets the tab ID from the top frame. I would suggest trying to get the tab ID from the current frame, and only going to a parent frame if it can't be retrieved.

https://github.com/DNNCommunity/dnn-elements/blob/91eecb25a5091838059d931eeeef7a1399c6ba94/packages/stencil-library/src/utilities/dnnServicesFramework.ts#L28-L31

[valadas]

But if I understand correctly, the situation here is that the resource manager is on a different page than the one where the model was opened from. So I would expect it to use the permissions of the page in that modal and not the underlying page right?

[bdukes]

Yes, you have the correct expectation, which is not what is currently happening. The tab ID from the underlying page is used, instead of the page of the iframe in the modal, so the API request fails because the module ID doesn't match the tab ID. As a workaround, adding a reference to that module to the hosting page allows it to work.

[valadas]

Haa, ok, I understood the opposite. Makes sense then