296786 - Sites are able to prevent the context menu from appearing (right-clicking doesn't work at msn.com)

Status: RESOLVED WORKSFORME

(Core :: Widget: Win32, defect)

Description

[IU]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050604 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050604 Firefox/1.0+

I was trying to block images on www.msn.com, but they have changed their web
page code and it is instead hijacking the right-click and treating it as an left
(or "action") click.


Reproducible: Always

Steps to Reproduce:
1. Visit www.msn.com
2. Right-click an image
3. Nuff said

Actual Results:  
Taken to a web page I had no intention of visiting

Expected Results:  
I would prefer an override so that "normal" behavior is possible and a context
menu appears.

Comment 1

[Kevin Brosnan]

Firefox does have this ablity, dom.event.contextmenu.enabled is the pref and can
be enabled by tools -> options -> content -> "but disable common annoyances".

However msn seems to be getting around this pref.

Comment 2

[IU]

> However msn seems to be getting around this pref.

Exactly.  And unfortunately. :-(

Comment 3

[zug_treno]

Reproducible with Mozilla 1.8b1, right clicking works again if I remove:
if(tw){event.returnValue=false;i.onload=iOL;i.onerror=iOE;tid=w.setTimeout(iTO,dl);
from http://hp.msn.com/scr/home/OOB1027.js .

Comment 4

[IU]

Interesting.  It seems Microsoft may be intentionally targetting mozilla
browsers.  If you use AdBlock to filter out the following javascript,
right-clicking works:

http://hp.msn.com/scr/home/msnmoz1021.js

Notice how the javascript file is called "msnmoz1021.js" (e.g. mozilla)?  If you
download and take a look at that javascript, you'll notice that it is mostly
coded to control the mouse actions.  Mighty nasty of them.

Is there a way of adding an option that will help a user prevent websites from
getting away with stunts like this?

Comment 5

[:Gavin Sharp [email: [e-mail]]]

*** Bug 298620 has been marked as a duplicate of this bug. ***

Comment 6

[Daniel Veditz [:dveditz]]

Confirming. The msnmoz1021.js file is not the culprit, that's just a
compatibility shim. Something changed in the way we fire click events between
1.0.3 and 1.0.4 -- in 1.0.4 the site's onclick handler gets right-clicks and
unintentionally prevents the context menu, in 1.0.3 and earlier it does not.

Comment 7

[Brendan Eich [:brendan]]

From my MSN contact:

Below is a very simple repro of the issue:

<script>
function doThis(ev)
{

     ev.preventDefault();
}
document.addEventListener("click",doThis,false)
</script>

This incorrectly disables right click.  We will be working around the issue
globally as follows:

function ValidateButton(ev)
{
if (ev.button==2) // Right mouse button - stop this event
    ev.stopPropagation();
}
document.addEventListener("click",ValidateButton,true);

/be

Comment 8

[Robert Jessop]

Here is another page which prevents the context menu from working, with or
without  dom.event.contextmenu.enabled set or "Disable Common Annoyances" enabled:

http://mp3-postcards.com/listen/?888

I'm using mozilla Deer Park Alpha 2 (Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.8b3) Gecko/20050712 Firefox/1.0+)

Comment 9

[Boris Zbarsky [:bzbarsky]]

Is this still an issue?  This seems to work just fine for me in a Seamonkey
trunk build on a testcase I tried and on msn.com both...

Comment 10

[IU]

(In reply to comment #9)
> Is this still an issue?  This seems to work just fine for me in a Seamonkey
> trunk build on a testcase I tried and on msn.com both...

Considering that this has not been patched, and sites like
http://demo.planzo.com and others I have not cataloged, can still get around the
Firefox "Disable or replace context menus" setting, I believe this is still an
issue.

Comment 11

[Boris Zbarsky [:bzbarsky]]

What are the steps to reproduce on that site, exactly?  Hard to fix a bug if I
don't know how to trigger it...

Comment 12

[IU]

(In reply to comment #11)
> What are the steps to reproduce on that site, exactly?  Hard to fix a bug if I
> don't know how to trigger it...

Simply go to the website and right-click anywhere except on the calendar. You
should notice that the context menu does not show - unless you double right-click.

Comment 13

[Boris Zbarsky [:bzbarsky]]

Oh, I see the problem.  You're on windows.  So context menus fire on mouseup,
not mousedown like they do on the other platforms.  So it looks like I won't be
able to actually reproduce this bug, so a minimal testcase would help a great
deal with being able to fix it...

Comment 14

[José Jeria]

Attachment: Testcase

This is a minimized testcase that resulted from going throught the code in
http://demo.planzo.com. They block the contextmenu with onclick and checking if
event.button is 2.

Click once, no contextmenu, double-click see menu. I guess the pref to disable
doesn't work because it check for oncontextmenu? Is this even a bug, or did I
misunderstood this?

Comment 15

[Boris Zbarsky [:bzbarsky]]

So it looks like the only code that fires NS_CONTEXTMENU events on Windows is
the widget code, and it does this in response to the WM_CONTEXTMENU message.  I
have no idea what Windows widgetry does when processing the WM_RBUTTONUP to
prevent the WM_CONTEXTMENU from coming in in this case.... maybe it shouldn't be
returning true from ProcessMessage for right-button mouseup or something?

Comment 16

[Corey Burger]

I see this with f1.com. Firefox 1.0.7 on Ubuntu. IMHO, site should be prevented
from doing this by default.

Comment 17

[Kevin Brosnan]

(In reply to comment #16)
This bug has nothing to do with f1.com, you can reenable the context menu by
edit -> preferences -> webfeatures -> advanced buton for javascript -> uncheck
allow sites to modify or replace the context menu. You still get the alert but
the context menu appears.

Comment 18

[Corey Burger]

Yes, I realize that. I want that setting to be the default.

Comment 19

[Kevin Brosnan]

This is not the bug to decide if that setting should be changed. I did a quick
search in bugzilla and did not see a but filed requesting that setting to be
changed for Firefox.

Comment 20

[yagood]

I see it on http://www.snooker.pl/ - with "allow sites to modify or replace the context menu" unchecked context menu doesn't appear after alert.

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a1) Gecko/20060121 Firefox/1.6a1 ID:2006012105

Comment 21

[Martijn Wargers (dead)]

Attachment: patch

This seems to work for the event.preventDefault case, which is what the testcase attached to this bug uses.
But it doesn't work for http://www.snooker.pl/ or bug 323047.
And now that I think about it, there are probably some more methods to disallow a user to get the right-click context menu.

Comment 22

[IU]

I have not seen this issue for a long time.  Reopen if it's still a problem.

Thanks