> From: Andreas Sandblad [mailto:sandblad@acc.umu.se] > I can only reproduce it together with user-interaction, that is manually > pressing refresh in Internet Explorer. I did some attempts to try to > automaticly refresh the page using javascript but without any luck > (denied access due to cross-site-policy). There is absolutely no requirement for any user-interaction, as you can programmatically click the Refresh button - or rather, trigger the exact same non-window-object-dependant non-cross-site functionality in the current window object where you have all the access you need. document.execCommand("Refresh"); http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/execcommand.asp Refresh is just one of the many command identifiers that document and range objects can utilize http://msdn.microsoft.com/workshop/author/dhtml/reference/commandids.asp Use a third window object to store the state on wether or not you have refreshed already, to avoid an infinite loop. Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher http://pivx.com/larholm/ - Get our research, join our mailinglist
