172657 - New group of tabs as "Home" does not work with javascript:home().

Status: NEW

(SeaMonkey :: Tabbed Browser, defect)

Description

[Jason Bassford]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2b) Gecko/20021004
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2b) Gecko/20021004

With bug 118835 checked in (Very nice!) we can define a group of tabs as our
Home page.  Also, clicking on the Home button brings this tab group up.

However, the URL "javascript:home()" does not bring up the "home" tab group -
instead it only brings up the *first* tab of the tab group.

Reproducible: Always

Steps to Reproduce:
1. Define a tab group and go to that "bookmark".
2. Set this group of tabs as your Home page.
3. Close all of the tabs (but one).
4. Click on the Home button - observe that all tabs are created.
5. Close all tabs but one again.
6. Go to the URL "javascript:home()".

Actual Results:  
Only the first tab of the currently defined "Home page" is loaded.

Expected Results:  
All of the tabs comprising the "Home page" should be loaded - just as they are
when you click on the Home button.

Comment 1

[jag (Peter Annema)]

Urgh.

Comment 2

[Ian Graham]

Wouldn't this be a security hole?  If you had a page script that recursively called:
javascript:home()
wouldn't this populate the tab bar with 'billions and billions' of 
tabs ... ??

Comment 3

[Jason Bassford]

I don't see how this is any more of a security hole than allowing
javascript:home() when you only have a SINGLE site defined as your home page. 
Nor any more of a security hole that JavaScript that loads a series of arbitary
pages.  But, if you think it is, I think that would be a different bug.

Comment 4

[Ian Graham]

If home() just re-loads a single page/tab, then the worst you can do is re-load
the same page over and over. Memory usage shouldn't grow. 

If home() re-loads (as it does now) a whole new set of tabs, memory growth can
be significant, in principle hanging the browser.... 

Of course you can kill both with the stop button ... but it was memory
consumption I was thinking about. ....

Comment 5

[Jason Bassford]

> If home() re-loads (as it does now) a whole new set of tabs, memory growth can
> be significant, in principle hanging the browser.... 

Ah - I see your point now.  Because loading the Home page, when it's a set of
tabs, does an append rather than a replace.

However, again, this is not an issue with javascript:home() per se but with how
going to your home page behaves.  (Clicking on the home button, or Go -> Home,
would have just the same kind of effect.)

Having Home *not* append, but replace existing tabs, is bug 188329.  If you
don't want external sites to be able to call javascript:home() at all (whether
or not more than one site is defined) that would be something else too.

Comment 6

[Ian Graham]

I don't see any security problem with the home user toolbar button (or the Go
--> Home menu).  And yes, I think the bug 188329 might make a nicer
implementation of this, but it is hard to implement in a consistent way (what
should 'home' do if some of the home page tabs are deleted - should it add in
the 'lost' ones - and if so, where on the sequcne of items of the tab-bar ....). 

THe current behavior has the benefit of simplicity of behavior (and of
implementation). 

But it's only the javascript function home() that presents a platform risk --
since it's only this function that is accessible to a page 'hacker'. 
The current behavior seems a decent, secure compromise. 

Comment 7

[Jason Bassford]

Okay.  But that only tangentially has to do with this bug.  (Like saying that a
connection to the Internet is a security risk because you can get viruses from
the connection.)  Please file a new bug about restricting javascript:home() so
that it will only be processed from localhost.

Comment 8

[Laurent Schneider]

I suggest that window.home does load the first homepage in current tab. Currently it loads the concatenated string (http://www.site1.com|http://www.site2.com), which eventually produces a 404.
Tested with firefox 2.0 and following link :
http://en-us.www.mozilla.com/en-US/firefox/2.0/whatsnew/ , "go home" 

Comment 9

[Adam Guthrie]

Dupe of bug 343999?

Comment 10

[Jason Bassford]

No, it doesn't appear to be a dupe.  Under Firefox, a 404 is generated.  Under SeaMonkey the original behaviour reported here (just loading the first tab) still happens.

Comment 11

[:Hb]

SM2 doesn't have the option "2. Set this group of tabs as your Home page." any more. WFM

Comment 12

[Jason Bassford]

The options still exists.

1. Set a group of tabs.
2. Go to the tab group.
3. Under Home Page, set "Use Current Group".

I did this with two different pages.  When I go to the URL javascript:home() the behaviour has still not changed.  Only the first page in my home group is used.

Comment 13

[:Hb]

Menu - Edit - Preferences - Browser - Homepage