120413 - Page able to open pop up windows even though they are disabled

Status: RESOLVED DUPLICATE of bug 126224

(Core :: DOM: Core & HTML, defect)

Description

[Jacek Furmankiewicz]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7) Gecko/20011221
BuildID:    0.9.7

I went to this CDNOW.com page and it opened a popup...even though I have "open
windows by themselves" switched OFF (and it works on other sites).
Obviously they must have found a way around that.

Reproducible: Always
Steps to Reproduce:
1. Disable pop ups (Preferences->Advanced->Switch OFF "open windows by themselves"
2.Go to the URL: 
http://cdnow.com/cgi-bin/mserver/SID=609001184/pagename=/RP/CDN/FIND/album.html/artistid=GALAS*DIAMANDA/itemid=170313

3.

Actual Results:  Pop up appears "Welcome to CDNOW, sign in to your account...etc"

Expected Results:  There should be no pop up

Comment 1

[Phil Schwartau]

Reassigning to DOM and to mstoltz; cc'ing jst, rginda
This may be what's doing it: 

<script language="JavaScript">

function openWelcome ()
{
  welcomewindow = open('http://cdnow.com/cgi-bin/mserver/SID=1104006024/
                        pagename=/RP/CDN/welcome.html', 'Welcome',                                                                               
                        'width=200,height=297,toolbar=no,location=no,
                        directories=no,status=no,menubar=no,scrollbars=no,
                        resizable=no,fullscreen=no');

  if (welcomewindow.opener == null)
    welcomewindow.opener = self;
}

</script>

<img src="http://gs.cdnow.com/graphics/spacer.gif" width=1 height=1                
onLoad="openWelcome(); return true;">

Comment 2

[Phil Schwartau]

Setting default QA -

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Aargh, they've caught on. We don't currently block opens in the onLoad handlers
of images. We might be able to do that, although this is ultimately a losing
battle - eventually they'll pop up windows on mouseMove or mouseDown events, and
then we'll really be screwed.

Comment 4

[Jacek Furmankiewicz]

Wouldn't it be simpler to keep track of whether a window is being opened via a
user clicking explicity on a page (so basically just process A HREF tags and
onClick()) and just disregarding everything else if this option is switched OFF?

Or is that too complex too implement in the current JS engine?

Comment 5

[Mitchell Stoltz (not reading bugmail)]

No, that's where we're headed, more or less, although it will be a lot of work.
And the more restrictive we are, the more likely we are to block non-ad windows.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

*** Bug 126905 has been marked as a duplicate of this bug. ***

Comment 7

[Phil Schwartau]

Setting default QA -

Comment 8

[Tom Mraz]

I think there would be ultimate solution in just allowing any popups from the
page's javascript only in some short time after user's click anywhere in the page.
It can be used for advertising too but the ad window would never appear without
explicit action of the user.

Comment 9

[Matthias Versen [:Matti]]

*** Bug 127757 has been marked as a duplicate of this bug. ***

Comment 10

[Alfonso Martinez]

Isn't this one the same that bug 126224 ? (fixed on trunk)

Comment 11

[Tom Mraz]

I'll make it a duplicate because this new solution is exactly the same as I
suggested in comment #8. And there is no way the first solution will work for
every trick the web developers could think of.

The new solution however needs UI work (it is only a text pref).


*** This bug has been marked as a duplicate of 126224 ***