Thanks for the report- could you try to configure CORS as explained in this How to configure cross origin resources sharing -> does it help remove such message?

Huh oh! I gave a read to the FAQ but I wasn't award about cors_domains[] configuration array.

I've set the * permissive value but didn't helped.

I supposed *.vmdev.local would work rather than explicitly nominate all the domains. Wouldn't be better a regex comparison? For example (\w+).vmdev.local

Doing this we could allow Superadmins adding all 3rd levels of each main domain without asking for sysop support editing config.ini file on server's file system.

You see we have more than an hundred websites, many of them are 3rd level being measured.

It should be enough to just put * as value for the cors domain.... strange it does not work.

Do you see an error in your browser console?

Still getting: Uncaught SecurityError: Blocked a frame with origin "http://vmdev.local" from accessing a frame with origin "http://stats.vmdev.local". Protocols, domains, and ports must match. error on Iron Browser (chrome fork). Firefox console doesn't log anything about it.

Using Firebug extension i got: "Error: Permission denied to access property 'Piwik_Overlay'
http://vmdev.local/piwik/index.php?module=Overlay&action=notifyParentIframe#http://vmdev.local/test/dummy/
Line 11"

In my config.inc.php theres cors_domains[] = * (piwik is latest master branch)

Can you please try apply the change in: b89cf6f - maybe it will solve the issue?

I've updated master branch to this latest commit but firebug stills logging the error in console.
The js code at line 11 is: piwikWindow.Piwik_Overlay.setCurrentUrl(window.location.hash.substring(1));

could you maybe email me access to the URL and piwik creds where I can see the issue? cheers

Unfortunately I'm testing on a local ubuntu LTS virtual machine hosted by my computer here in the office at work. I'll try in the next days to reproduce this problem in a different environment outsite in the interwebz to get deeper in the issue. Let's keep in touch and thank your very much for now. 🐛

I tried to reproduce this issue but couldn't. In my case it was apache.piwik and plugins.piwik which are both local domains as well. Tried it in Chrome and Apache.

Maybe have a look which headers are sent by your local website.

The content of the left sidebar should be loaded in the context of your Piwik domain from what I can see in the code so CORS should not be needed

Well I've tested on different domains and it worksforme also. Sorry for wrong issue submission. 😲