Reputation: 117
I started learning web development at a company, and was tasked with making a simple app in cookiecutter django, and then integrating django-cms into it.
I used django cookie-cutter to start a project, and then integrated django-cms into the project following this guide :
https://github.com/pydanny/cookiecutter-django
http://docs.django-cms.org/en/latest/how_to/install.html
After some initial trouble, I managed to get it going. After that, the next step was to add my "polls" app to the project and integrate Django CMS in it aswell.
For that I followed this tutorial :
I managed to get all the way to the end of the last link, and then on step 6, this happens.
Every time I try to delete a plugin from my site, or when I click create on the CMS toolbar i get this error (note: if I log in to /admin, I can create the page, but not via the cms menu bar on the actual website) :
The form could not be loaded. Please check that the server is running correctly.
The server is all good. No errors there.
And in the console :
Refused to display 'http://127.0.0.1:8000/cms_wizard/create/?page=5&language=en&edit&cms_path=/home/?edit&language=en&structure' in a frame because it set 'X-Frame-Options' to 'deny'.
bundle.toolbar.min.js:1 [Deprecation] Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.
I have been googling for the past two days, and I just cannot figure it out. Any help would be greatly appreciated !
I have pushed the files I changed on my github, if you need any other info please let me know, I will include it right away.
https://github.com/sandilukez/cms-django-cookie
I tried everything I could find online, with no luck !
Upvotes: 3
Views: 1221
Reputation: 523
Anser update 11 july 2021
i success fixed the issue thanks lot @user2135738
settings.py file inside the your django project
#django cms allow all
X_FRAME_OPTIONS = "ALLOWALL"
XS_SHARING_ALLOWED_METHODS = ["POST", "GET", "OPTIONS", "PUT", "DELETE"]
Upvotes: 0
Reputation: 708
The answer above is a close one, at least point where the problem is, but the answer, X_FRAME_OPTIONS = "ALLOWALL"
might cause security problems.
as it is mentioned in the django documentation
Modern browsers honor the X-Frame-Options HTTP header that indicates whether or not a resource is allowed to load within a frame or iframe. If the response contains the header with a value of SAMEORIGIN then the browser will only load the resource in a frame if the request originated from the same site.
For django cms to be able to open iframes inside the website we should put X_FRAME_OPTIONS = 'SAMEORIGIN'
in our settings. So that we don't allow other website to include our website as iframe but let django cms work properly.
For more information, here is the related documentation: https://docs.djangoproject.com/en/3.1/ref/clickjacking/
Upvotes: 4