176304 - Option to disallow scripts from hiding toolbars

Status: NEW

(Firefox :: Settings UI, enhancement, P5)

Description

[Jonathan Harford]

In Preferences > Advanced > Javascript, we're able to forbid pages from taking
certain liberties, such as grabbing focus, moving windows, etc. I propose that
three more options be added to this "Allow scripts to" menu:
* Hide menubar
* Hide toolbar
* Hide scrollbar
I find it very frustrating when I am forced to navigate a site in a crippled window.

Comment 1

[Asa Dotzler [:asa]]

pref("dom.disable_window_open_feature.titlebar",    false);
pref("dom.disable_window_open_feature.close",       false);
pref("dom.disable_window_open_feature.toolbar",     false);
pref("dom.disable_window_open_feature.location",    false);
pref("dom.disable_window_open_feature.directories", false);
pref("dom.disable_window_open_feature.personalbar", false);
pref("dom.disable_window_open_feature.menubar",     false);
pref("dom.disable_window_open_feature.scrollbars",  false);
pref("dom.disable_window_open_feature.resizable",   false);
pref("dom.disable_window_open_feature.minimizable", false);
pref("dom.disable_window_open_feature.status",      false);

Comment 2

[Jonathan Harford]

Well, now, that's just delightful. Are there plans to add them to the
Preferences list? There definitely appears to be room.

Comment 3

[David Tenser [:djst]]

I agree, there should be a way of disabling JavaScripts to hide the toolbar for
example. In fact, I think all 11 options should be included, not just the
current 7 options. The list to contain all these options is huge anyway, and
it's under the advanced options.

Comment 4

[Stefan Huszics]

Ahh greate to see that the backend is already there.

Is there any special reason to not add the frontent UI for it? Seems like a
nobrainer to me, but I might be missing something not readily obvious.

Comment 5

[Jesse Ruderman]

This could be a single option: "Allow scripts to hide toolbars" or "Allow
scripts to hide toolbars in subwindows".

Comment 6

[alanjstr]

Should those prefs be true instead of false to do the disabling?

Comment 7

[Jesse Ruderman]

This pref would probably be placed with the existing "Allow scripts to..."
prefs. Unchecking a box in that list disables something.

Comment 8

[Asa Dotzler [:asa]]

setting rfe status to New.

Comment 9

[Gérard Talbot]

Re: comment #2:
- Unless I'm mistaken, directories and personalbar refer to the same chrome bar.
- I think titlebar should never ever be removable, either by user prefs settings
and not even in signed scripts. Disallowing the user from moving a sub-window,
preventing him from accessing the system icons (minimize, maximize, close) and
preventing him from accessing the system menu (Restore, Move, Size, etc..) is
really over-excessive control over the user's window. I think "Allow scripts
to... remove titlebar" should not even be listed, therefore making it impossible
to remove the titlebar.

Re: comment #5: If there is going to be one single option, then I like the
wording "Allow scripts to hide toolbars in sub-windows" because it explicitly
identifies sub-windows. I think resizable, minimizable, close, scrollbars should
be apart. So how about

Allow scripts to:
...
[ ] Hide toolbars in sub-windows
[ ] Prevent resizing of sub-windows
[ ] Prevent minimizing of sub-windows
[ ] Hide scrollbars in sub-windows

and I'm voting for this bug :)

Comment 10

[Gérard Talbot]

pref("dom.disable_window_open_feature.chrome",    true);
will NOT disable, counter "chrome=yes". All other
pref("dom.disable_window_open_feature.xxxx", true);
seem to be achieving their goals except the case of window feature chrome.

chrome=yes is VERY powerful as it will remove menubar, toolbar, location bar,
personalbar, tab bar and statusbar. All these toolbar removals will happen
despite other user prefs and settings. Even if you have "Allow scripts to: Hide
the status bar" checkbox UNCHECKED, the status bar will be removed.

Comment 11

[Gérard Talbot]

Sorry. Forgot to say that I tested this with XP Pro SP1, 1.3a Gecko/20021224
Phoenix/0.5 at both
http://jibbering.com/du/MozPopupHelpTestcaseDebugger.html
http://www.din.or.jp/~hagi3/JavaScript/JSTips/Mozilla/Samples/winopen.htm

Comment 12

[Jacob Keller]

Attachment: a patch to add options to advanced script control

I have just made a patch to add almost all the options to the advance script
dialog, will test as soon as it builds

Comment 13

[Mike Connor [:mconnor]]

taking QA contact, sorry about the bugspam

Comment 14

[Gérard Talbot]

Comments regarding the patch:

1- It should be
prefstring="dom.disable_window_open_feature.scrollbars"/>
and not
prefstring="dom.disable_window_open_feature.scrollbar"/>

2- "Hide the resize button": I'm sure this will be source of confusion. You see,
right now each window has a window resizing grippy (bug 27795) at its right
bottom in the status bar (unless the window is narrower than 316px and/or
shorter than 134px) and could have no system icon resize button (top right in
the title bar). On top of that, you're not hiding the resize button: you're
disabling it. You allow scripts to disable an icon; you then later add another
icon (grippy resizing) to resize windows. I find all this unneedlessly
complicated; it's contradictory, inconsequent and UI counter-productive. FYI,
since Opera 7.0 beta 1 until today with the latest version (now Opera 7.21), all
windows are resizable, always resizable: no UI setting to do, no user.js to
edit, no menu item to check, no exception. Clean and clear interface. Also I
never heard a single user complaining about not being able to set, allow or
disallow scripts from disableing window resizability.

3- "Hide the scrollbar": More should be said somewhere about what this feature
exactly do. When "scrollbars=no" is requested in the windowFeatures string list
of window.open(), it actually removes scrollbar(s) even if they were needed,
even if content was overflowing requested window dimensions. When
"scrollbars=yes" is in the windowFeatures string list of window.open(),
scrollbars will be rendered scrollbar(s) only if they are needed, only if
content overflows requested window dimensions. So, turning off the "Hide the
scrollbar" option still might not render scrollbar(s) at all. I just wish this
could be explained somewhere.
Btw, I think it should be worded "Remove scrollbar(s)" instead of "Hide the
scrollbar".

4- "Hide the close button" vs "Close windows": Again, this will be source of
confusion, normal users will be mind boggled here. You can actually remove a
close window system icon and still allow script to be able to close the window.
You can actually render a close window system icon and prevent scripts from
closing a window. I understand that but will it be the case for users?

For sure, some explanations in an helpfile will be needed to support, document
these settings.

5- You need enhanced security privileges to remove title bar and to remove the
system close (icon) button. I wonder why presence of title bar and presence of
close system icon should not always be assured in all cases - no exception -
without any UI setting to do. Again, all versions Opera 6+ never allowed scripts
to remove these.

6- directories (also personalbar which is an alias) are missing in the patch: is
that an oversight or a deliberate decision?

7- "Hide the toolbar" is misleading. How about "Remove Navigation Toolbar"?

My 2 cents

Comment 15

[Gérard Talbot]

*** Bug 259190 has been marked as a duplicate of this bug. ***

Comment 16

[Daniel Kabs, reporting bugs since 2002]

(In reply to comment #10)
> chrome=yes is VERY powerful as it will remove menubar, toolbar, location bar,
> personalbar, tab bar and statusbar. All these toolbar removals will happen
> despite other user prefs and settings. Even if you have "Allow scripts to: Hide
> the status bar" checkbox UNCHECKED, the status bar will be removed.

I tried this with Mozilla 1.7.2 but neither the status bar nor the location bar
(dom.disable_window_open_feature.location=true) had been removed in the new
window. Seems to me that Mozilla hands all power over to the users and not to
the scripts - just as it should be!

Comment 17

[Norbert]

I think a GUI option for "dom.disable_window_open_feature.resizable" would suit
good in "Advanced JavaScript Options"!

Comment 18

[Elmar Ludwig]

*** Bug 296527 has been marked as a duplicate of this bug. ***

Comment 19

[Worcester12345]

(In reply to comment #17)
> I think a GUI option for "dom.disable_window_open_feature.resizable" would suit
> good in "Advanced JavaScript Options"!

...or something like that. 

Give a bug number and I'd vote for it.

Comment 20

[Jesse Ruderman]

That's bug 101509 or bug 177838.

Comment 21

[Chris Wood]

Is it possible for scripts to disable extension-added toolbars?

Comment 22

[Mike Connor [:mconnor]]

Not specifically extension-added toolbars, no.

Comment 23

[RNicoletto]

Possible workarounds:
1 - JavaScript Options ==> https://addons.mozilla.org/firefox/addon/6527
2 - Unhide Menubar ==> https://addons.mozilla.org/firefox/addon/3678