onBlur="self.close()" closes all mozilla windows

VERIFIED WORKSFORME

Status

()

--
critical
VERIFIED WORKSFORME
17 years ago
17 years ago

People

(Reporter: db, Assigned: joki)

Tracking

({crash, testcase})

Trunk
x86
All
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

17 years ago
On a page I visited there was an image and a onBlur="self.close()", when I try
to open just the image all open mozilla windows are closed and mozilla is shut down.

I have isolated it into a small testcase that I will attach as sone as the bug
is filed.

The step to reproduce is to view the (soon to be) attached html page and
rightclick on the image. When you select "View image" all of mozilla will close
down.

I use mozilla 1.0 (2002060511) in linux.
(Reporter)

Comment 1

17 years ago
Created attachment 88485 [details]
testcase

Rightclick image, select "View Image" and all mozilla windows closes

Comment 2

17 years ago
Following the steps to reproduce crashes me: 2002061712 trunk, WinXP

Talkback: TB7585530M

Confirming, +crash, ->critical, OS->All

Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash, testcase
OS: Linux → All

Comment 3

17 years ago
Doesnt happen for me on win98 build 2002-06-24-08-trunk...

Comment 4

17 years ago
now WFM, winXP 2002062308.  Might have been fixed.

reporter: can you re-test with a build from 20020623 or later, please?
Created attachment 92166 [details]
testcase

Problem is bigger. Mozilla allows to close any window by widnow.close() or
self.close() . It's security bug and should be fixed. window.close() should be
able only for windows opened from script.

Comment 6

17 years ago
Zbigniew: what build are you using
both testcases here WFM with linux trunk build 20020721 and branch build 20020719
Windows 2002071813

I also checked 2002071914 for Linux.

In both my testcase closed window.

Comment 8

17 years ago
yes, it's supposed to close the window.  this bug is that "self.close()" crashes
Mozilla.  If you think windows should be unable to close themselves, that's a
different bug.
Yes. I'm pretty sure that script shoudl never be able to close not_its window.

If it's another bug, then i'll fill it. Is it?

Comment 10

17 years ago
marking WORKSFORME.

Zbigniew:
your testcase *does* close its own window.  if you think that shouldn't happen
it's going to have to be a DOM security pref, because it's not a bug by itself.

It's not possible for a script to close a window other than itself which it did
not open simply because it has no way of locating such a window (AFAIK).
Status: NEW → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → WORKSFORME
Andrew: But my testcase close window opened by myself, not by script. This is
the problem. Script should be able only to close windows, opened by this script.
(Reporter)

Comment 12

17 years ago
I can just confirm that with 1.1 beta this works as it should and the problem I
had before have been fixed. Now only one window is closed and no crash.

Comment 13

17 years ago
verifying per coments
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.