Last Comment Bug 104495 - scripts can create a window with no close box using close=no
: scripts can create a window with no close box using close=no
Status: VERIFIED FIXED
:
Product: Core
Classification: Components
Component: Security (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla0.9.6
Assigned To: Mitchell Stoltz (not reading bugmail)
: bsharma
:
Mentors:
javascript:window.open('','','close=n...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2001-10-12 16:06 PDT by Mitchell Stoltz (not reading bugmail)
Modified: 2002-09-05 16:25 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch - can't hide close box without privileges (1.34 KB, patch)
2001-10-12 16:08 PDT, Mitchell Stoltz (not reading bugmail)
jst: review+
jst: superreview+
Details | Diff | Splinter Review

Description Mitchell Stoltz (not reading bugmail) 2001-10-12 16:06:01 PDT
It's possible for a script to create a window with no close box. The window can
still be closed with a keyboard shortcut, but some users may not be aware of
this, in which case they're stuck with a window they can't close except by
killing the browser. This is not good.
Comment 1 Mitchell Stoltz (not reading bugmail) 2001-10-12 16:08:28 PDT
Created attachment 53356 [details] [diff] [review]
Patch - can't hide close box without privileges
Comment 2 Mitchell Stoltz (not reading bugmail) 2001-10-12 16:10:50 PDT
The problem with this patch is that it will probably cause close boxes to always
appear on JS alerts, confirms, and prompts. These currently have close boxes
under Windows, but not on other platforms and there's a bug to fix that (50521).
Comment 3 Dan M 2001-10-15 11:09:54 PDT
The Mac crowd will howl when this goes in, and bug 50521 was more a suggestion
than a bug. It's pretty common for Windows apps to have close boxes on their
alerts. I see a storm coming. But I see the need for this bug, too. r=danm.
Comment 4 Mitchell Stoltz (not reading bugmail) 2001-10-15 14:18:34 PDT
Actually, I tested this patch on Mac, and alerts still have no close boxes, even
though the security code in nsWindowWatcher::CalculateChromeFlags is now setting
the has-closebox flag to true. I'm not sure why; the security code is being
overridden somewhere in that case, but the result is exactly what we want, so I
say we go with it.
Comment 5 Johnny Stenback (:jst, jst@mozilla.com) 2001-10-25 18:57:25 PDT
Comment on attachment 53356 [details] [diff] [review]
Patch - can't hide close box without privileges

sr=jst
Comment 6 Mitchell Stoltz (not reading bugmail) 2001-10-31 10:47:28 PST
Fix checked in.
Comment 7 bsharma 2001-10-31 12:05:01 PST
Verified on 2001-10-31-Trunk build on WinNT

A window is opened with a close box using above test case.

Note You need to log in before you can comment on or make changes to this bug.