118993 - Use separate security checks for focusing frames/windows

Status: RESOLVED DUPLICATE of bug 300453

(Core :: Security, defect)

Description

[Henrik Gemal]

I have a frameset ala:
<frame>
<framset src="t1.html" name="t1">
<framset src="t1.html" name="t2">
</frame>

Then in t1.html I do:
onclick=parent.t2.focus()
then I get:

Error: uncaught exception: Permission denied to call method Window.focus

t1 and t2 are on the same server...

why?

and why is it "uncaught" ?

build 20020108

Comment 1

[Boris Zbarsky [:bzbarsky]]

It's uncaught because you did not catch it (using a try/catch).  The weird thing
is that all.js has:

pref("capability.policy.default.Window.focus", "allAccess");

So this error should not be occurring...

Comment 2

[Henrik Gemal]

Attachment: ZIP file with test case. contains 3 files

Comment 3

[Jesse Ruderman]

Gemal, have you unchecked "Allow web pages to... raise or lower windows" in
advanced prefs?  That might cause this error, since the function for focusing a
frame is the same as the function for focusing a window (!).

Comment 4

[Henrik Gemal]

it was the pref setting. Sorry about that.

Comment 5

[Jesse Ruderman]

Setting a pref to prevent web pages from raising/lowering windows shouldn't
break scripts that just try to focus frames.  Unfortunately, the function call
is the same for both.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Jesse, wouldn't your last comment just make this a duplicate of the "content
controls should not stop script execution" bug?

Comment 7

[Jesse Ruderman]

A call to focus() should succeed when it takes place within a framed document. 
In that case, it shouldn't cause Mozilla to switch windows or tabs, regardless
of the security pref.  Fixing bug 122866 would make this bug less of a problem
but wouldn't take care of it completely.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Changing description to "Use separate security checks for focusing frames/windows."

Comment 9

[Jesse Ruderman]

See also bug 196922, frame.focus() should not bring window to top.

Comment 10

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 300453 ***