Home page blank when testing with frame breaker

[godin5150]

Hope somebody can help. I'm running the newest version 1.5.5e with the following plugins:
snap affiliates
ultimate urls
testimonial manager
monthly sales manager
simple google analytics

The site works fine when you type the url in your browser. The problem is I use solo ads to promote and when I click to test if my site breaks frames it shows a blank page.

My site: http://www.etrafficgenius.com

You can see what I'm talking about by going here and enter my url:
http://vitaladviews.com/framebreaktest.html

I was thinking it might be a .htaccess issue. I tried renaming the .htaccess but it did not help, it just causes the ultimate urls to not work.

Any help is really appreciated.

[mc12345678]

when I click to test if my site breaks frames it shows a blank page.

I don't recall all the explanation/details, but basically this was a feature added to ZC 1.5.5 to prevent spoofing the website or allowing user data entry to be "processed" through another's site and appear as if still only on the site expected. Meaning, you are seeing what is expected/as designed.

Basically, ZC is not intended to be run through a frame.

[godin5150]

I don't recall all the explanation/details, but basically this was a feature added to ZC 1.5.5 to prevent spoofing the website or allowing user data entry to be "processed" through another's site and appear as if still only on the site expected. Meaning, you are seeing what is expected/as designed.

Basically, ZC is not intended to be run through a frame.

That's good to know. So to make life easier I should revert back to my older version install 1.5.3
I know it works on that.. Weird but good to know moving forward.

[DrByte]

That's good to know. So to make life easier I should revert back to my older version install 1.5.3
I know it works on that.. Weird but good to know moving forward.

Reverting is a bad idea.

If you have thoroughly studied EXACTLY why removing the best-practice configuration of protecting against the widely-understood-as-bad use of frames for e-commerce and payment processing, and sites which store customers identity information, then go ahead and remove the one line from html_header.php for X-Frame-Options BUT ONLY IF you've become an expert in all matters of security.

Most stores are asking "how do I ADD" the protection, NEVER how to remove it.

And all site-security scanners will object to the removal of the protection.

Just keep these things in mind when going in a non-standard non-recommended direction.

[mc12345678]

That's good to know. So to make life easier I should revert back to my older version install 1.5.3
I know it works on that.. Weird but good to know moving forward.

Yeah, what he said...



No, I wouldn't suggest reverting. DrByte has posted somewhere about the specific line(s) involved but I thought the majority of the code was in the html_header.php file for the common template directory associated with the latest version. There might be another location that also needs to be modified to support, but be sure you understand the potential security issues to you and more importantly to your customers introduced by undoing that protection.

Also, as far as reverting: if the database has already been upgraded, there's not really a downgrade option.

[godin5150]

Thanks for the information. I will leave alone on the newer version.