Safecracker (ExpressionEngine) not working in Facebook page

Question

I'm using ExpressionEngine and Safecracker to build a simple Facebook app that runs inside of a FB page.

My code functions properly outside of the Facebook page, but inside the page it shows a blank screen. I've been able to narrow it down to this piece of code:

{exp:safecracker channel="lekker_fietsen_competitie" return="/"}
<input type="text" name="title" value=""><br>
<textarea name="description"></textarea><br>
<input type="file" name="image"><br>
<input type="submit">
{/exp:safecracker}

I'm guessing that Safecracker is somehow violating what I can and can not do inside a FB page, but I can't see what it is.

Things I've tried:

• hidden fields are allowed inside a FB page, they work properly, so they are not the cause of the problem
• the scripts and other stuff that's generated by Safecracker works inside the FB page; I've hard-coded all of it and there seems to be no problem if hard coded

You'd say the solution is easy: hard code the form. But I can't, because the form has two fields like ExpressionEngine needs to write the entry:

<input type="hidden" name="meta" value="cIssFx0NbcTnVxs7mWiSvwx0OwJ62c0KKoeGbZu8RMTHMJfNsv/OS0q8mtPh9HLmu/
    ru2n8a5J4S3wgyB8c+XWBdNfUrTCeWNrKYwDOxSkxB34I5UNN8XpVQt/
    wYc5FajtTx4VyGomwAHZ0vC7gXTxH4cYhU/zGx7S/UB6DgAyKk3cnl2f3+zbDId
    +KbU7msE0O1AJX3Nx7QaE6IpKJpXnQeiMISCHC1aOxJriZ/5eWIhqZdDz18rRbs4
    kdHCQ9RChFPtiB4rtjxque1CGylWj+OjiTaEVA68IVmC7c3AFrL9Wf4wxojOchPmlEx
    0W2OD5T/ERy0mV6GbCnkAZcQRdQjgjx3Rd7SQrXOO6u7gHh+vqrzw/y/y7dqlMz1LGmrj
    kdnOqdM/9bPej8Sp+3dCo2mDjf4WgCfLKze3P7XgLc=">
<input type="hidden" name="XID" value="1fba9120c5e00cfcb665bd0c7e147757b7888847">

So, where to go from here? What terms/guidelines might I be violating?

Answer 1

I submitted a ticket and did the following. Naviagate to expressionengine -> libraries -> Cp.php and go to line 75. Ticket https://support.ellislab.com/bugs/detail/19663

ee()->output->set_header('X-Frame-Options: SameOrigin');

Replace with

if (isset($_GET['D']) AND $_GET['D'] == 'cp')
{
    ee()->output->set_header('X-Frame-Options: SameOrigin');
}