Why is the access denied?

Question

JavaScript

TinyMCE + Elfinder is installed on the site

Elfinder is loaded in a frame, after downloading the desired file, a link to it is inserted into the editor in this way:

// pass selected file path to TinyMCE
parent.tinymce.activeEditor.windowManager.getParams().setUrl(file.url);

// close popup window
parent.tinymce.activeEditor.windowManager.close();

Everything works fine, but the site needed to install Dklab_Realplexor :

<script type="text/javascript" src="http://rpl.mydomain.com/?identifier=SCRIPT&<?=time()?>"></script>
<script type="text/javascript">
    $(function () {
        var realplexor = new Dklab_Realplexor('http://rpl.mydomain.com/', 'test_');
        realplexor.subscribe("Alpha", function(data) { alert("Alpha: " + data) });
        realplexor.execute();

    });
</script>

As soon as the Dklab_Realplexor connection is started, when adding a link to tinyMCE, this error:

Error: Permission denied to access property "tinymce"
parent.tinymce.activeEditor.windowManager.getParams().setUrl(file.url);

Those. For some reason, there is no access to the parent element. Why is there such a conflict? How can I fix it?

I understand that Dklab_Realplexor (judging by this script ), creates its own invisible frame, is this the reason?

Answer 1

Those. for some reason I can't access the parent element

Because there is no permission to access the parent element.

Answer 2

The sandbox attribute may contain a space-separated list of restrictions that are not needed:
allow-same-origin
A browser may not consider a document in an iframe to be from another domain. If the iframe is already from another domain, then nothing changes.
allow-top-navigation
Allows the iframe to change parent.location.
allow-forms
Allows submitting forms from an iframe.
allow-scripts
Allows the execution of scripts from the iframe. But scripts, nevertheless, will be forbidden to open popups.
The purpose of the sandbox attribute is to impose additional restrictions. It cannot remove existing ones, in particular, remove security restrictions if the iframe is from another source.

<iframe src="URL" sandbox="allow-same-origin || allow-top-navigation || allow-forms || allow-scripts"></iframe>