265942 - Arbitrary numbers of popups can be made with a single onclick

Status: RESOLVED DUPLICATE of bug 197919

(SeaMonkey :: UI Design, defect)

Description

[Michael Kuster]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de-AT; rv:1.7.3) Gecko/20040910
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de-AT; rv:1.7.3) Gecko/20040910

There are 9 possibilities to show a PoPup. Mozillas PoPup Blocker, has blocked
8 of 9 cases. Congratulations on you!

Only step 5/9, described as follows, failed:

Stress test attempt to overcome your pop-up killer by trying to spawn large
numbers of windows as quickly as possible. This is a very synthetic test, since
only a malicious site would attempt to open more than half a dozen pop-up
windows at once. Never attempt this test without your popup killer running. When
the test is run, exactly one pop-up window should be allowed to open by your
popup killer (as it is supposed to).

Reproducible: Always
Steps to Reproduce:
Run the PopUp test

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

this may have been fixed in the meantime, not sure...

Comment 2

[Frank Wein [:mcsmurf]]

With a current build it still works. The code used here is
  function test1(){
    for (i = 0; i<5; i++){
      //open a new window with a minimal interface (but still resizable)
     
window.open("./popup.html","_blank","height=200,width=200,menubar=no,scrollbars=no,status=no,toolbar=no");
    }
    return;
  }

to open the popups.

Comment 3

[Ng Ming Hong]

Should make the title more descriptive, e.g. Loads of popups activated with a
single click are not blocked

By the way, I wonder whether we should block this type of popups.

Comment 4

[Gérard Talbot]

Mozilla 1.8a5 build 2004102505 and Firefox 1.0 PR1 rv:1.7.3 build 20041024 do
better than Opera 7.54 (which fails tests 3 and 5) but worse than MSIE 6 SP2
under XP Pro SV1 (which lets only 1 popup window to be opened in test 5).

NEW

Comment 5

[dolphinling]

The number of windows that can open seems to be arbitrary. (I tested with 50.)
Whether or not this is a popup blocking issue, it's definitely a bug, and
critical as it could probably be a crasher if the number of windows were high
enough.

I'll attach a simplified testcase.

Comment 6

[dolphinling]

Attachment: Simplified testcase that opens 10 popups

Comment 7

[Boris Zbarsky [:bzbarsky]]

If you click, you expect something to happen, clearly.  A number of perfectly
reasonable sites make two window.open() calls in onclick handlers.. So just
capping this at 1 is not an option.

Note that we have existing bugs on this; this one is a duplicate.

Comment 8

[Johnny Stenback (:jst)]

Interestinly enough IE does seem to cap it at 1. I must say I haven't really
seen any sites that open more than one window from a click... but that of course
doesn't mean that they don't exist...

Comment 9

[Gérard Talbot]

> I must say I haven't really seen any sites that open more than one window 
> from a click...

Here's one which even shows/teaches how to do this:
http://www.w3schools.com/js/tryit.asp?filename=tryjs_multiwindows
coming from
http://www.w3schools.com/htmldom/dom_obj_window.asp
where one chooses the link
"Open multiple windows with one click"

No loop in the code, but it does open several windows. Mozilla 1.8a6 build
2005010105 under XP Pro SP2 here.

Comment 10

[Charles Fenwick]

Re Status Whiteboard and Comment seven, this bug may be a duplicate of bug 197919.

Comment 11

[Robert Parenton]

*** This bug has been marked as a duplicate of 197919 ***