176320 - Minimal innerWidth/innerHeight values for popup windows (minimum size)

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Gérard Talbot]

There should be a strict and rigid minimal innerWidth and innerHeight values for
popup windows, without any cutting off of the generated popup windows.

According to previous references, the minimal innerWidth and innerHeight values
for NS 4.x was 100px x 100px. 

http://developer.netscape.com/docs/technote/javascript/window/images/display_screen.gif

First make sure you have Preferences.../Advanced/Scripts & plugins/Allow scripts
to:/Raise or lower windows checkbox checked and Hide the statusbar checkbox checked.

Now, load the page at the given url and fill in 400 for the outerWidth and 100
for the outerHeight field (only check the titlebar checkbox; you may also check
the scrollbars checkbox). The innerHeight value of the generated popup window
will be 76 pixels precisely (100 - 20 - 4 which is outerHeight minus titlebar
height minus bottom window [re-]sizing border/handle). The value given for the
innerHeight in the popup is 150 pixels which is obviously wrong.
Important note: innerHeight includes the height of horizontal scrollbar (=16px)
if present.

Load the same page at the given url and fill in 100 for the outerWidth and 400
for the outerHeight. The innerWidth value of the generated popup window will be
107 pixels and not 100 pixels. Here, the popup window is NOT cut off and the
returned value for the innerHeight in the popup is 107 pixels which is correct.
Important note: innerWidth includes the width of vertical scrollbar (=16px) if
present.

In testing these popups, make sure that:
- resizable checkbox is unchecked (for safety)
- sizeToContent() disabled is checked

You can check the checkbox scrollbars as scrollbars presence do not change the
innerWidth/innerHeight values at all. If you did not requested the presence of
scrollbars in the popup, you can still scroll up/down the popup with the
PgUp/PgDn keys.

If you select one or some or all possible chrome elements/bars, then the visible
part of the content area will be further reduced while the given, returned
innerHeight value in the generated popup will still disply 150 pixels.

There ought to be a strict and rigid minimal innerWidth and innerHeight values
for any generated popup window, despite and regardless of any value edited by
the author in the open() method. It should be at least 100 x 100 , if not 150 x 150.

Final note: bug 161093 is about user setting [limits] minimal size values for
generated popup windows while this bug is about [browser] hard coded minimal
size values for generated popup windows.

Using XP Pro SP1 and build 2002102308

Comment 1

[Gérard Talbot]

In the Final note, I meant bug 161903 (not 161093).

Comment 2

[Gérard Talbot]

"innerHeight
Specifies the vertical dimension, in pixels, of the window's content area.
(...)
Description
To create a window smaller than 100 x 100 pixels, set this property in a signed
script.

Security
To set the inner height of a window to a size smaller than 100 x 100 or larger
than the screen can accommodate, you need the UniversalBrowserWrite privilege."
found at
http://developer.netscape.com/docs/manuals/js/client/jsref/window.htm#1202410

Comment 3

[Gérard Talbot]

According to Client-Side JavaScript Guide (javascript version 1.3), Chapter 14,
JavaScript Security

one needs expanded security priviledges in order

"To set the inner width of a window to a size smaller than 100 x 100 or larger
than the screen can accommodate.
innerHeight
To set the inner height of a window to a size smaller than 100 x 100 or larger
than the screen can accommodate."
found at
http://developer.netscape.com/docs/manuals/js/client/jsguide/sec.htm#1024603

Now, this reference clearly suggests, points to minimal values for the content
area dimensions here, not the outerWidth/outerHeight values.

If the window features list string has 113 and 100 values for outerWidth and
outerHeight but no values for innerWidth (or width) and innerHeight (or
height)**1**, then these 113 and 100 values will be used and applied. This does
not make sense and this does not comply with given security limits and usability
basic common sense. 

The current situation allows anyone to create a 113[outerWidth]x100[outerHeight]
secondary child window which can have all of the chrome bars: in such case, the
viewable content area is/will be zero, nil.

-------
**1** : because outer* values have a double precedence over inner* values, even
that is not true. Go to the given URL and type in 113 for outerWidth, 100 for
outerHeight and 444 for innerWidth and 444 for innerHeight: the resulting child
window will be 113x100. (The file at the given URL explains this precedence).

Comment 4

[Gérard Talbot]

Attachment: Screenshot of a popup window with outerWidth=200 and outerHeight=130

With many chrome bars (menubar, personalbar, locationbar, tab bar, statusbar),
we see that NO CONTENT at all is displayed, the personalbar is clipped, the
locationbar and the statusbar are not visible, etc... We see how awkward and
irrelevant minimal values on outerWidth and outerHeight can be. Right now, one
can create a popup window with an outerWidth of 113px and an outerHeight of
100px.

I believe there should be only 1 set of minimal values: 100 pixels both applied
only to innerWidth and innerHeight .

Comment 5

[Gérard Talbot]

In the document "Signed Scripts in Mozilla"
http://www.mozilla.org/projects/security/components/signed-scripts.html
it is said that
"resizeTo, resizeBy: To resize a window smaller than 100 x 100 pixels or larger
than the screen can accommodate."
but the parameters of resizeTo are outerWidth and outerHeight. Allowing
outerWidth and outerHeight to be 100px is automatically allowing innerWidth and
innerHeight to be LESS than 100px as the titlebar takes 16px and window
[re-]sizing borders/handles take 4px each (+any additional chrome bars).
IMO, only the specified or computed values of innerWidth and innerHeight should
be considered for signed scripts. Same thing with setting them like
window.open(strUrl, "WindowName",
"titlebar=yes,menubar=yes,personalbar=yes,status=yes,outerWidth=100,outerHeight=100");
Once generated, it's blatant obvious that the innerHeight will be much less than
100px.

Comment 6

[Johnny Stenback (:jst)]

Mass-reassigning bugs to [e-mail]

Comment 7

[Andreas Lange]

The checkin for bug 239876 changes some things regarding the computation and min
values of inner[width|height].

Comment 8

[Felix Miata]

adding "minimum size" to summary to make finding with search more effective

Comment 9

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.