1340634 - If popups are allowed, pages can freely spawn extra pages (with window.open) when the beforeunload event fires, thus preventing the user from closing the site

Status: RESOLVED DUPLICATE of bug 675574

(Core :: DOM: Core & HTML, defect, P3)

Description

[Augusto]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131

Steps to reproduce:

Estava testando um script em javascript, e acabei descobrindo um bug. Segue o código javascript. Basta criar um arquivo HTML com esse código. Se você marcar para permitir popups, o bug ocorrerá.

<script>

function onunload (){
    window.open('logout.php');
}

window.onbeforeunload = function() {
	onunload();
    return 'You have unsaved changes!';
}
</script>


Actual results:

Após criar o arquivo, acessar a página, e permitir popups, você não conseguira mais fechar a página. Sempre que tentar  fechar a página irá abrir outra, mesmo tentando com "Ctrl + W" ou "Alt + F4", até mesmo quando tentar recarregar a página, ele abre uma nova aba. Para acabar, tem que desabilitar o javascript.


Expected results:

O firefox não deveria permitir que o javascript tenha tanto controle(poder).

Comment 1

[Daniel Veditz [:dveditz]]

This is a known trick that I thought we had a dialog to help users break out of. Probably a dupe of one of the many child bugs of the "eviltraps" bug.

Comment 2

[:Gijs (he/him)]

Poor man's (hi google translate) translation of comment #0:
> I was testing a script in javascript, and I discovered a bug. The javascript code follows.
> Just create an HTML file with this code. If you allow popups, the bug will occur.

<script>

function onunload (){
    window.open('logout.php');
}

window.onbeforeunload = function() {
	onunload();
    return 'You have unsaved changes!';
}
</script>

> Actual results:
> After creating the file, accessing the page, and allowing popups, you could no longer close the page.
> Whenever you try to close the page it will open another one, even trying with "Ctrl + W" or "Alt + F4"
> even when trying to reload the page, it opens a new tab. To finish, you have to disable javascript.
>
> Expected results:
> Firefox should not allow javascript to have so much control (power).

Comment 3

[Vlad Bacia-Mociran [:VladB]]

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0

I have tested your issue on latest Firefox release v52.0, latest Nightly build (Build ID: 20170316030211) and managed to reproduce it only on Firefox release version. On Firefox v52 whenever you try to close the page it will open another one. On latest Nightly version the page can be closed, but when it is closed another one is opened and that too can be closed.

Can you please retest this using latest Nightly build (https://nightly.mozilla.org/) and report back the results?

Comment 4

[Augusto]

I have tested on Nightly, and I have the same problem. But as they said, if I block the popup, the problem is solved.
I see this as a big problem for normal users, without much knowledge. They will end up rebooting the system to close the browser.