248138 - Links with <target> don't work properly

Status: RESOLVED WONTFIX

(Firefox :: General, defect)

Description

[Michael Busshaus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a2) Gecko/20040620 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a2) Gecko/20040620 Firefox/0.8.0+

Since the new Browser Firefox 0.9, our Links in the Transaction-Area (Pop-Up)
won´t work correct. When you start "www.sbroker.de" and click on the link "Zum
Depot" and in the opening Pop-up you need to click at e.g. "Sicherheitshinweise".
This Link
<http://www.sbroker.de/cgi-bin/get2post.pl?FORM_ACTION=%2Fcontent&CONTENT_URL=http%3A%2F%2Fwww.s-broker.onvista.de%2F6_4_sicherheit.html>
is connected with a traget="sbrokermain", so taht normally the window
"sbrokermain" does a reload with this url. Since Firefox 0.9, this doesn´t work
anymore

Reproducible: Always
Steps to Reproduce:
1.
2.
3.



Expected Results:  
To load the Link in the window, called by the target.

Comment 1

[PikeUK]

Does the information in the third bullet of the Known Issues part of the Release
Notes help:

http://www.mozilla.org/products/firefox/releases/#issues

Comment 2

[Michael Busshaus]

Hi Pike, this info may help, but in my "about:config" there ist no option
"ocshell.frameloadcheck.disabled"?

Comment 3

[Michael Busshaus]

Hi Pike, this info may help, but in my "about:config" there ist no option
"docshell.frameloadcheck.disabled"?

Comment 4

[PikeUK]

(In reply to comment #3)
> Hi Pike, this info may help, but in my "about:config" there ist no option
> "docshell.frameloadcheck.disabled"?

Open about:config, right-click and select New->Boolean to add it.

Comment 5

[Michael Busshaus]

this change fixes the "bug". is it possible, that firefox set the default to true?

Comment 6

[Jesse Ruderman]

The security check was added to fix a security hole (spoofing).  Ironically, any
site that breaks due to the security check can be spoofed in vulnerable browsers
(such as Internet Explorer, Opera, and older versions of Firefox).

You need to change the site so that the frameset and pop-up transaction window
come from the same host/port.  (You might end up needing to make everything come
from the same host/port.)

Comment 7

[Jesse Ruderman]

The "FIXED" resolution should only be used when a (known) change was made to
Mozilla code to fix the problem.  Use "WONTFIX" or "INVALID" or move the bug to
tech evangelism.