0

I know this is a popular question, but none of the provided answers seem to be straight forward.

In Pseudocode/Jquery it would be something like:

if (X-Frame-Options detected) { 
$('a[target="iframe"]').click(function()) {
$('a[target="_blank"]').show();
})
}

Any help would be appreciated!

Thank you!

starfx
  • 25
  • 1
  • 8
  • I would like to mention that the links are from another domain, so the error is Refused to display 'link' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'. The intention is to give to the user a 'Open in new Tab' button. – starfx Oct 13 '15 at 20:43

1 Answers1

1

After further research I found the answer on stackoverflow: Detect X-Frame-Options and Catching "Display forbidden by X-Frame-Options”.

PHP Script:

$error=false;
$urlhere=$_GET["url"];
$ch = curl_init();

$options = array(
    CURLOPT_URL            => $urlhere,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER         => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_ENCODING       => "",
    CURLOPT_AUTOREFERER    => true,
    CURLOPT_CONNECTTIMEOUT => 120,
    CURLOPT_TIMEOUT        => 120,
    CURLOPT_MAXREDIRS      => 10,
);
curl_setopt_array($ch, $options);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch);
$headers=substr($response, 0, $httpCode['header_size']);
if(strpos($headers, 'X-Frame-Options: deny')>-1||strpos($headers, 'X-Frame-Options: SAMEORIGIN')>-1) {
    $error=true;
}
$httpcode= curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo json_encode(array('httpcode'=>$httpcode, 'error'=>$error));

AJAX Request:

$('a').click(function () {
    $.getJSON("source/script.php?url="+this, function (data) {
     if (data.error) { 
      $('iframe').hide();
      $(".iframe-error").show();
    } else { 
      $(".iframe-error").hide();
      $('iframe]').show();
    }
  });
  });

The code to display the iframe and the link to the new tab still needs to be further developed.

starfx
  • 25
  • 1
  • 8
  • I have experienced the case of the headers sometimes being different (deny vs Deny vs DENY) etc. To get around this I surrounded the `substr` with a quick `strtolower()` and modifying the following conditional to suit – Darren H Nov 09 '16 at 14:21