127480 - page redefines openDialog() and fails

Status: RESOLVED DUPLICATE of bug 141442

(Core :: Security: CAPS, defect)

Description

[pblack88]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204
BuildID:    20002020415

THIS IS A MOZILLA PROBLEM
there are a bunch of pull down selection boxes, like what this page has, but
nothing happens after you press the go button. I loaded the page in galeon, and
it all worked fine.  So this is a mozilla problem.

Reproducible: Always
Steps to Reproduce:
1. go to http://web14.compaq.com/falco/sp_list.asp?cat=Desktop
2. select any combination of options for the type/series/model/os
3.  press go, nothing happens

Actual Results:  nothing. a new page should have been loaded, but it just sits
there.

Expected Results:  mozilla should have loaded a page pertaining to software drivers.

I can't think of anything that would be important, I don't know if this happens
at other sites or not.  This is the first I have seen of it.
I don't know if it is important, but the page loads and works fine with a
previous version of Mozilla  {Build ID:  2001061002}

Comment 1

[Boris Zbarsky [:bzbarsky]]

The page defines

function openDialog(url, left, top, width, height, returnFunc, name, args)

This obviously conflicts with our internal openDialog() function and the
security manager blocks the attempt to define the function, since it treats it
as an attempt to set window.openDialog.

Why didn't we use to block that setting before?

Comment 2

[Fabian Guisset]

We should just move openDialog to nsIDOMChromeWindow

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Boris,
   We blocked the calling of openDialog because it has a pretty seroius hole -
see bug 56009. I think this is a WONTFIX, what do you think?

Comment 4

[Boris Zbarsky [:bzbarsky]]

I think Fabian's suggestion makes the most sense.  Failing that, we should
evangelize the site...

Comment 5

[Olav Vitters]

*** Bug 134454 has been marked as a duplicate of this bug. ***

Comment 6

[Mitchell Stoltz (not reading bugmail)]

*** This bug has been marked as a duplicate of 141442 ***