Merge lp:~edwin-grubbs/launchpad/bug-421898-cross-site-timeline-graph into lp:launchpad

[Edwin Grubbs]

[Edwin Grubbs (edwin-grubbs)]

Summary
-------

A user wanted to embed the timeline graph on their website. This was not working due to the timeline graph's javascript trying to access the parent of the iframe across domain names, which triggered a browser security error. This branch fixes the problem by changing resize_frame to default to an empty string instead of nothing, since that gets converted to "None", since that variable is usually a string matching the id of the iframe.

Tests
-----

./bin/lp-windmill test=lib/canonical/launchpad/windmill/tests/test_registry/test_timeline_graph.py firefox http://launchpad.dev:8085

Demo and Q/A
------------

Demo:
* Start up launchpad.dev
  * Open http://launchpadlibrarian.net/32631714/test_iframe.html
  * You should see the timeline graph, even though the iframe is on the launchpadlibrarian.net domain.

QA:
* Open http://launchpadlibrarian.net/32632477/test_edge_iframe.html
  * You should see the timeline graph, even though the iframe is on the launchpadlibrarian.net domain.

[Aaron Bentley (abentley)]

review: Approve (code)

=== modified file 'lib/lp/registry/templates/object-timeline-graph.pt'
--- lib/lp/registry/templates/object-timeline-graph.pt	2009-07-17 17:59:07 +0000
+++ lib/lp/registry/templates/object-timeline-graph.pt	2009-09-28 21:05:25 +0000
@@ -94,8 +94,8 @@
   </script>
   <script
     tal:define="
-      include_inactive request/form/include_inactive | nothing;
-      resize_frame request/form/resize_frame | nothing"
+      include_inactive request/form/include_inactive | string:false;
+      resize_frame request/form/resize_frame | string:"
     tal:content="
       string: show_timeline_graph('${include_inactive}', '${resize_frame}');"/>