I'm a relative newbie with DotNetNuke (although not with the web in general), and am involved with an implementation project that includes someone with more DNN experience than me. We have an application we want to offer on the site which we do not have time to port to the new environment but which runs just fine on the old site. Although it would not be my first choice of how to do it, it seems to me that a reasonable quick solution would be to add an iframe inside an html module on the new site and access the application on the old site through it. The other guy says it should be absolutely forbidden to do that, that is poses grave security risks, but can't tell me why.

I googled the situation, and did find a reference to a cross-site scripting exploit a few years back that applied to the DotNetNuke iframe module (which I am not proposing we use) and which was patched.  Is there really a security risk here if we do what I propose?

By the way, the application we are hosting in the iframe does not require a login or use sessions. It is a collection of a few php driven forms with some spry javascript validation routines built in that does some database interaction and send some emails about the transactions. A little too complicated for some of the DNN forms modules and not quite complicated enough for developing a standalone module (and we are on a deadline, so a quick and temporary solution would probably be acceptible).

Any suggestions about the level of risk, and links to specific info if there is a risk, would be much appreciated.

Thanks,

Barry