284680 - Address bar disappears in the popup opened by this page

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[Luis Couso]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050223 Firefox/1.0.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050223 Firefox/1.0.1

In the page at http://www.megaproxy.com/freesurf/, when you type an url, a popup
is opened. That popups tries to mimic a browser. But that popup also makes the
address bar of Firefox to disapear. I don't know if that is intentionnal from
the webmaster or if there is a bug with the mimic process.


Reproducible: Always

Steps to Reproduce:
1. Go to http://www.megaproxy.com/freesurf/
2. Enter an url to browse and click the "Surf!" button
3. Observe the missing address bar in the opened popup.

Actual Results:  
The popup is missing the address bar.
I found no way to make it appear again (well, i haven't searched for long :D)

Expected Results:  
A web page should not be able to interact with any component of the browser. So
the address bar should not disappear.

I have tested this on FireFox 1.0.1 on Linux and Windows XP.
On linux i tested with my every-day profile. On Windows i tested with my
every-day profile and also with a blank profile, same results.

Comment 1

[Jesse Ruderman]

Discussion about spoofing the address bar is already public, so making this bug
report public.

Comment 2

[u88484]

My addressbar did not disappear. 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050302
Firefox/1.0+

Comment 3

[Dan M]

I *know* you guys have already determined this, but since it hasn't been stated
in the bug I guess I feel obligated to make it explicit. megaproxy is simply
omitting the |location| feature when opening a window. This'll do it:

<a href="javascript:window.open('about:mozilla','','toolbar');void(0)">

The location feature of window.open was introduced in Netscape 2 / IE 3. I
suppose in the modern era of increased security concerns we should be certain
before closing this bug, but it strikes me as invalid.

Kurt (comment 2): obviously you have the
dom.disable_window_open_feature.location pref set true. That's not standard.

Comment 4

[Daniel Veditz [:dveditz]]

Invalid -- they've obviously turned off the address bar on purpose so new
addresses will remain within their anonymous service. Leaving the address bar
could result in a horrible mistake (how horrible would depend on your reasons
for needing an anonymizing service); hiding it means people only have to open a
new browser window or go back to the freesurf launch page if that's what they
really inteded to do.

Works the same way in IE.

We attempted to change the default for the location bar to make it un-hidable
(see middle-ish of bug 22183, or possibly a spin-off bug referenced there) but
got too many protests from web-app developers and had to back it out.