JIRA Gantt Chart add-on gadget will not display in Confluence - get error message
Asked by Ryan Goodwin:

Anyone seen this error/warning when trying to use this gadget in Confluence:

Security Aspect:

You are not allowed to request content from within the JIRA Gantt-Chart gadget, most likely due to your same-origin-policy!


Answers:
author: Frank Polscheit
body: Hi Ryan,

that's not a bug: it is a problem of your infrastructure set-up. Your browsers detect that security violation and prevent loading data in the background. You can find more information about "same origin policy" using Google/Yahoo or what search engine you prefer.

Your internet-protocol, domain and port must be the same for JIRA and Confluence like <http://x.y.z:8080/jira> and <http://x.y.z:8080/confluence>. If you configure your Atlassian systems like this, it works quite well and your users will be happy and secure as well!

I will not implement a workaround to disable the browsers default behaviour, which opens security holes as it really make sense to have that. Just image, you are browsing a web-site and content is loaded in the background from <http://hacker.com> or something equivalent!

Regards,  
Frank


author: Chad Hill
body: I believe I was encountering this issue and have managed to resolve it with a few deeper tweaks.

**First, my problem:**

We wanted to separate our jira and confluence servers for both simpler urls and discrete resource management. So I moved confluence from issues.server.com/confluence to [wiki.server.com](http://wiki.server.com).

I left our jira server at issues.server.com/jira

Suddenly, the gantt charts aren't displaying. Same Origin policy error in browser console, ah crud.

**My Solution:**

I used CORS to solve this. This required a change to the apache config (enabling CORS for the trusted server) on the jira server and modifying a JS file within the JPlugs plugin jar file.

Here's the change to your virtual host in apache:

```
# Enable CORS for http(s)://*.YOURDOMAIN Origins  &lt;IfModule mod_headers.c&gt;    SetEnvIfNoCase Origin "(http(s)?://)((.+)\.)?(YOURDOMAIN)$" AccessControlAllowOrigin=$1$3$5    Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin    Header set Access-Control-Allow-Credentials true env=AccessControlAllowOrigin    SetEnvIfNoCase Access-Control-Request-Method "(.+)" AccessControlRequestMethod    Header set Access-Control-Allow-Methods "GET,POST,HEAD" env=AccessControlRequestMethod    SetEnvIfNoCase Access-Control-Request-Headers "(.+)" AccessControlRequestHeaders    Header set Access-Control-Request-Headers "X-Requested-With" env=AccessControlRequestHeaders  &lt;/IfModule&gt;
```

And I changed com/jplugs/plugin/gantt/includes/jsjplugs/jplugs-js-gantt.js within the plugin jar. Around line 1448, we see:

```
if (window.XMLHttpRequest) {         xhttp=new XMLHttpRequest(); } else // IE 5/6 {         xhttp=new ActiveXObject("Microsoft.XMLHTTP"); } xhttp.open("GET",content,false); xhttp.send(); xmlDoc=xhttp.responseXML;
```

Simply add a line after creating a new XMLHTTPRequest object:

```
if (window.XMLHttpRequest) {         xhttp=new XMLHttpRequest();         xhttp.withCredentials=true; } else // IE 5/6 {         xhttp=new ActiveXObject("Microsoft.XMLHTTP"); } xhttp.open("GET",content,false); xhttp.send(); xmlDoc=xhttp.responseXML;
```

That will instruct the browser that its OK to send cookies in cross domain requests utilizing the CORS headers in the request/response.

**Note that this requires you to edit the plugin, which likely means you void the warranty or support agreement or EULA or someones patent. Take Frank's warning seriously and only use my hack if you really need to.**

comments: author: Vladimir Muravlev
body: Chad, for what version of plugin is your solution?

I could not find com/jplugs/plugin/gantt/includes/jsjplugs/jplugs-js-gantt.js within plugin_1133294473520394069_gantt-2.4.0-JIRA5.2-UPM2.10.jar


author: Chad Hill
body: Looks like we're on version 2.2.0 still.


author: Vladimir Muravlev
body: I have some progress on this issue. In fact I got it working for some time.

Thanks to Frank he send me a pre-release of version 2.4.1 of his plugin. I configured apache as Chad recommended

The only thing that was missing - apache module headers.c was not enabled by default

I uncommented this string in httpd.conf

LoadModule headers_module modules/mod_headers.so

and voila, it works! Gadget contents showing in confluence.

I tried to show the result to another user and all he saw was JIRA logon screen instead of Gantt chart.

I made logoff/logon in JIRA and Confluence on my machine, and after that I got JIRA logon screen inside of a gadget in Confluence.

And since than I can never get it back working :(

I tried logging in and out, reinstalled plugin, but no use.

JIRA logges this line

2013-10-31 14:03:22,526 http-bio-8080-exec-5 WARN anonymous 843x2100x1 - 10.0.109.90,10.0.109.115 /plugins/servlet/gantt-issues \[jira.plugins.servlet.GanttServlet\] user is not logged in -\> force redirect to login screen

Please someone give me a hint.


author: Chad Hill
body: I'm sorry Frank, I should of paid more attention to the labels.

My mod is for com.jplugs.plugin.gantt, version 2.2.0, which is not what this question was about. Apologies for the confusion.


author: Vladimir Muravlev
body: Chad, can you clarify, did you solve issue with Frank's plugin (and what corrections did you make to that plugin) or with some other plugin?


author: Frank Polscheit
body: "jsjplugs/jplugs-js-gantt.js" is a different addon and NOT my Gantt-Chart addon (please see on Atlassian Marketplace)!

Regards,  
Frank


author: Chad Hill
body: Great to hear, thats one less hack I have to maintain going forward. Thank you! :)


author: Frank Polscheit
body: Good job, thank's for publishing your CORS-based solution. I have updated my source code an included the following code snippet within the Gantt-Gadget:

xhttp.withCredentials=true;

It will be published with Gantt-Chart v2.4.1 soon.

Regards,  
Frank


author: Ryan Goodwin
body: Same issue as reported here:

[http://webcache.googleusercontent.com/search?q=cache:mzSxVbB19YsJ:https://studio.plugins.atlassian.com/browse/JIRAGANTT-67%3Fpage%3Dcom.atlassian.streams.streams-jira-plugin:activity-stream-issue-tab\&hl=en\&gl=us\&strip=1](http://webcache.googleusercontent.com/search?q=cache:mzSxVbB19YsJ:https://studio.plugins.atlassian.com/browse/JIRAGANTT-67%3Fpage%3Dcom.atlassian.streams.streams-jira-plugin:activity-stream-issue-tab&hl=en&gl=us&strip=1)

which no longer exists except in google cache....


Tags: jira