How to find out if document is loaded in frameset or not?

MungoBBQ

Hi!

I've got a method for determining whether a document is loaded as a frame from a specific frameset or not, by checking the HTTP_REFERER for the name of the frameset document.

In short, I have a frameset document called theframes.php which loads the frames nav.php and main.php. The document main.php is not supposed to ever be allowed to load if it's not part of the frameset.

So here's what I have in the top of main.php:

if (!eregi("theframes", $HTTP_REFERER)) { 
  header("Location: theframes.php");
  exit;
  }

This works like a charm when I use my IE 6 on Windows XP. However, I just discovered that if a user comes with a Mac OS X browser (IE and Camino tested so far), the $HTTP_REFERER is left blank. I've since discovered that the HTTP_REFERER is only set if the web browser wants to set it, so this is obviously not the way for me to check this.

Now, does anybody out there have another idea on how I can make sure that main.nav is always loaded as part of my frameset?

Thanks!

//Mans

bobthedog

AFAiK, you aren't going to be able to do this from the server side. The server has no notion of framesets etc, and just serves out one page at a time.

Therefore, the answer to this lies at the client side, and - surprise surprise - in that lovely Javascript language.

More or less, when a page loads (you can generally do this before the page completes rendering) you want to check whether

window.top == window

If they match then use some more JS to redirect the top page to your frameset..

window.top.location='blah.php';

Of course, you can be a bit cleverer and check the names of the frames if you want to ensure that they really are the frames you expected, but I leave this up to you

MungoBBQ

I thought of that, but my problem is that I want to do the check at the top of the code, in my general include PHP file. I could do it with JAvascript, but the JS-code for the check would then end up before any other tags, even the <HTML>-tag, which I'm not sure is a good idea...?

bobthedog

Well - its got to be done client side at some point or another, since this is the only place you are going to reliably find out whether you are in a frameset or not.

I have used a similar method before, and just done a JS redirect as soon as I possible could in the page (if appropriate).