1257437 - allow separate pop-up windows to be turned into tabs

Status: UNCONFIRMED

(Core :: DOM: Core & HTML, defect, P5)

Description

[alexios]

Attachment: test.png

User Agent: Mozilla/5.0 (Windows NT 10.0; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160303134406

Steps to reproduce:

1. i visited https://www.ups.com/content/gr/en/index.jsx
2. i clicked an image/link on the down right corner to learn more about a service they provide.
3. a pop up window opened that didn't have any controls to it nor i was able to make it a tab by dragging it to the main firefox window.


Actual results:

a pop up window opened that i wasn't able to make it a tab by dragging it to the main firefox window.


Expected results:

the user should be able to select via a right click context menu on the window title bar, if he wants to make that window a tab and place it on the main firefox window or in a new one.

Comment 1

[Loic]

I'm not sure pop-ups are designed for that.

Comment 2

[alexios]

yes i know, but i think it would be a useful addition. maybe someone would like to keep that pop-up and "convert" it into a normal tab.

Comment 3

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, untouched DOM/Storage bug's priority.

If you have reason to believe, this is wrong, please write a comment and ni :jstutte.

Comment 4

[David Chmelik]

This is 𝘢𝘳𝘨𝘶𝘢𝘣𝘭𝘺 root of a 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐬𝐬𝐮𝐞; everyone 𝘩𝘢𝘵𝘦𝘴 popups, but 𝘵𝘩𝘰𝘶𝘴𝘢𝘯𝘥𝘴/𝘮𝘪𝘭𝘭𝘪𝘰𝘯𝘴 𝘴𝘪𝘵𝘦𝘴 do it: a major problem is 𝐟𝐚𝐤𝐞 𝐩𝐨𝐩𝐮𝐩𝐬 within a site's window, used to 𝐜𝐫𝐚𝐜𝐤/𝐬𝐭𝐞𝐚𝐥/𝐩𝐡𝐢𝐬𝐡 so arguably 𝘢𝘭𝘭 popups should 𝘥𝘦𝘧𝘢𝘶𝘭𝘵 redirect to tabs... at least give users the option and at 𝘭𝘦𝘢𝘴𝘵 𝘵𝘦𝘭𝘭 𝘦𝘷𝘦𝘳𝘺𝘰𝘯𝘦 𝘸𝘩𝘺 it's a critical security issue that could lead to them 𝗹𝗼𝘀𝗶𝗻𝗴 𝗲𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴.
        Merely blocking popups is outdated problematic behaviour because sometimes trusted sites popup relevant/important information but just haven't updated to tabs--I've missed relevant & time-sensitive account/notification information that way.
        It's laughable true critical security issues like this go on for decades when programmers younger than safer-than-HTTP-protocols like gopher & FTP (can be dangerous for servers if misconfigured but generally not users) remove those out of ignorance & paranoia.