Firefox Error: Permission Denied to get Window.Document

Answer 1

First off, please post the code being run when you click those links, and their html.

secondly, did you have a typo there? Window.document should be window.document, should it? (lowercase w)

Edit response to changes in OP question

Without the html it's a little hard to say, but If I were taking a stab in the dark, I'd say this line:

headerFrame.document.body.style.backgroundColor = "Black";

is causing the error. It looks like headerFrame is on a different domain and you don't, for security reasons, have permission to modify the contents of that frame. Of course, some of the following lines will also have the same issue.

Also see http://userscripts.org/topics/25029 and http://www.webdeveloper.com/forum/showthread.php?t=189515 for similar cases.

Edit 2

From Mozilla Development Center

Note: Firefox 3 alters the security for windows' documents so that only the domain from which it was located can access the document. While this may break some existing sites, it's a move made by both Firefox 3 and Internet Explorer 7, and results in improved security.

(see https://developer.mozilla.org/En/DOM/Window.document)

Answer 2

Have you tried installing Firebug and figuring out which line is throwing the error? I'm guessing that since the question is tagged Firefox you are seeing this occur in it.

It'd be most helpful if you could post a template HTML page using this Javascript.

Answer 3

Is the script/frame pages all on the same domain? If not, this is expected. You can't access window.document from another window if they are not on the same domain.

Answer 4

I would guess you're trying to manipulate the window or document from a different origin. HTML5 (and all modern browsers, even IE :D ) enforce (or attempt to enforce) what is called "The Same-Origin Policy". Basically JS from one origin cannot interact with the DOM of a document or window from a different origin.

What is an origin? At a basic level you could substitute domain for origin and almost be right, but the full set of rules are

• You must have the same domain
• The same port (eg. code on example.com:80 cannot reference the DOM of a page a example.com:8080)
• The same protocol (eg. http://example.com is a different origin from https://example.com)
• lastly, redirects also matter so (http://example.com -> http://example.com/?redirect=http://evil.com with the server responding with a 3xx redirect to http://evil.com will result in a different origin)

In all liklihood firefox has merely tightened up one area where they did not apply the same origin policy in the past.

Answer 5

Apparently, the user in question updated his installation without changing the following setting to "false", which allows local documents to have access to all other local documents.

pref("security.fileuri.strict_origin_policy", true);

Which explains why I was unable to duplicate the error on my machine.

Many thanks to all for your assistance.