Last Comment Bug 343999 - window.home() incorrectly handles multiple home pages specified with |
: window.home() incorrectly handles multiple home pages specified with |
Status: ASSIGNED
: fixed1.8.0.12, fixed1.8.1.4, helpwanted, privacy
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: All All
: -- normal with 6 votes (vote)
: ---
Assigned To: Johnny Stenback (:jst, jst@mozilla.com)
:
Mentors:
http://bonsai.mozilla.org/cvsblame.cg...
: 347945 349414 354678 366422 370563 371766 (view as bug list)
Depends on: 221445
Blocks:
  Show dependency treegraph
 
Reported: 2006-07-08 23:01 PDT by Michael Ventnor
Modified: 2014-09-16 04:38 PDT (History)
25 users (show)
dveditz: blocking1.8.1.4+
dveditz: blocking1.8.0.12+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix the privacy issue. (1.37 KB, patch)
2007-02-09 15:58 PST, Johnny Stenback (:jst, jst@mozilla.com)
jonas: review+
dveditz: superreview+
dveditz: approval1.8.1.4+
dveditz: approval1.8.0.12+
Details | Diff | Review

Description Michael Ventnor 2006-07-08 23:01:42 PDT
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a3) Gecko/20060526 BonEcho/2.0a3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a3) Gecko/20060526 BonEcho/2.0a3

Whenever the window.home() function is called and the user has multiple home pages specified, Firefox will attempt to load it as one gigantic URL instead of handling it properly.

Reproducible: Always

Steps to Reproduce:
1. Specify home page URL's separated by |. I used "http://en-US.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official|http://video.google.com/"
2. Clicking the home button handles this correctly.
3. Now type in "javascript:window.home()" in the address bar. Firefox will attempt to load it all as one page.

Actual Results:  
Firefox tries to load the specified URL's as one long URL.

Expected Results:  
Firefox should either a) Open the first URL in the current tab and all other URL's in new tabs as is the default behaviour, or b) Offer different behaviour for window.home() and open just the first URL in the current tab, since many sites would assume you only have one home page.

Safe Browsing's "Get me out of here!" is also showing this behaviour, my guess is that Safe Browsing calls window.home()?
Comment 1 Michael Ventnor 2006-07-08 23:06:11 PDT
Actually scratch (b) from my suggestions, I reckon everyone using this feature would expect (a) to happen.
Comment 2 Jesse Ruderman 2006-07-08 23:30:32 PDT
See also bug 221445.  This might get fixed there.
Comment 3 Simon Bünzli 2006-07-13 00:10:43 PDT
I'd rather see behavior (b) in this case since it might not be obvious to the user that his/her homepage(s) were loaded which can be confusing if a web page suddenly spawns several tabs.
Comment 4 Michael Ventnor 2006-07-14 00:10:48 PDT
(In reply to comment #3)
> I'd rather see behavior (b) in this case since it might not be obvious to the
> user that his/her homepage(s) were loaded which can be confusing if a web page
> suddenly spawns several tabs.
> 

In that case, would strtok solve this issue? I don't have a compiler so I can't make or test a patch myself...
Comment 5 Simon Bünzli 2006-07-14 00:37:34 PDT
As long bug 221445 doesn't change the separator from the pipe to some character which isn't valid in URLs (e.g. a space), splitting up the homepage is no option. The apparently mis-behaving code is also used by other applications (e.g. SeaMonkey) which allow pipes as regular characters. Breaking these just because some Firefox devs once made an unlucky decision isn't likely to be happening.
Comment 6 Peter 2006-08-03 09:23:36 PDT
After firefox just updated itself, it showed the "Firefox has been Updated" page:

http://www.mozilla.com/firefox/updated

with a link (bottom left) "Go to my home page" of:

javascript:window.home();

I have three homepages setup (stored with the | character) and clicking this link tried to load the combined URL in the current tab.  I agree with the additional poster that the expected result should be (a) Open the first URL in the current tab and all other URL's in new tabs.
Comment 7 Michael Lelli 2006-08-05 08:32:44 PDT
I'm going to guess that the reason this hasn't been fixed yet is because there hasn't been any agreement on what to make the home method do.

I myself would like it to only open the first homepage in the tab, but if there could also be a preference to the behavior of the method, along with the home button. Only problem is that might confuse some people by making them think that if they set it to only open the first homepage, the browser will only open one page at start-up.
Comment 8 Phil Ringnalda (:philor) 2006-08-20 09:51:02 PDT
*** Bug 349414 has been marked as a duplicate of this bug. ***
Comment 9 Wayne Goode 2006-09-17 12:46:13 PDT
*** Bug 347945 has been marked as a duplicate of this bug. ***
Comment 10 Mark Tyndall 2006-09-28 06:33:58 PDT
*** Bug 354678 has been marked as a duplicate of this bug. ***
Comment 11 Thorsten Hirsch 2006-10-23 08:14:39 PDT
At least you could try to avoid using javascript:window.home(); But after updating to v2.0, you'll see http://de.www.mozilla.com/de/firefox/2.0/whatsnew/ with a button linked to the javascript function again. I guess I'm not the only one who stumbles over this bug just because of the whatsnew-page right after updating.
Comment 12 Olivier Mengué 2006-11-08 17:16:20 PST
(In reply to comment #11)
> I guess I'm not the only
> one who stumbles over this bug just because of the whatsnew-page right after
> updating.

Yes, you are not. I just upgraded to Firefox 1.5.0.8 and found the bug.
window.home() is used here: http://www.mozilla.com/en-US/firefox/updated

This is a PRIVACY ISSUE as it reveals to the server of my first home page the URLs of my others pages.
Comment 13 Nick Thomas [:nthomas] 2007-01-09 04:55:18 PST
*** Bug 366422 has been marked as a duplicate of this bug. ***
Comment 14 Jonas Sicking (:sicking) 2007-01-29 16:48:32 PST
Marking blocking due to privacy issue. At the very least we could simply grab the first url and use that when window.home() is called
Comment 15 Michael Ventnor 2007-02-07 01:21:21 PST
(In reply to comment #5)
> The apparently mis-behaving code is also used by other applications
> (e.g. SeaMonkey) which allow pipes as regular characters. Breaking these just
> because some Firefox devs once made an unlucky decision isn't likely to be
> happening.

#ifdef MOZ_PHOENIX should be a viable option then, at least for the time being. I may sound like someone who's capable of fixing this but I'm not. I'm a C++ newbie (I usually stay within the javascript parts of Mozilla) but I thought I could easily fix this bug. Boy was I wrong. I really need to learn C++ and the internals of Mozilla :)

Comment 16 Johnny Stenback (:jst, jst@mozilla.com) 2007-02-09 15:58:01 PST
Created attachment 254589 [details] [diff] [review]
Fix the privacy issue.

This solves the privacy issue involved here, but doesn't actually fix the problem. I don't think we can, or even want to, fix the actual problem here before bug 221445 is fixed. This is based on Michael Ventnor's idea of using MOZ_PHOENIX to determine whether we need to do this or not.
Comment 17 Johnny Stenback (:jst, jst@mozilla.com) 2007-02-09 15:59:55 PST
Josh, is this something that we need to worry about for Camino as well?
Comment 18 Michael Ventnor 2007-02-09 18:34:18 PST
Thanks Johnny, I had no idea NSStrings had those functions which is probably why I had so much trouble fixing it myself. :/ This looks like a nice, trivial bandaid for the 1.8 branch. Is it a good idea to request approval1.8.1.3?
Comment 19 Johnny Stenback (:jst, jst@mozilla.com) 2007-02-10 09:29:32 PST
Yes, given that this is a potential privacy problem, absolutely!
Comment 20 Phil Ringnalda (:philor) 2007-02-15 22:50:07 PST
*** Bug 370563 has been marked as a duplicate of this bug. ***
Comment 21 Josh Aas 2007-02-22 11:23:00 PST
smorgan - is this an issue for Camino?
Comment 22 Chris Lawson (gone) 2007-02-22 11:26:00 PST
(In reply to comment #21)
> smorgan - is this an issue for Camino?

It shouldn't be, since Camino doesn't currently support multiple home pages, and isn't going to use Firefox's display method when we do.

See also bug 189930 for how we're planning to do this.
Comment 23 Adam Guthrie 2007-02-26 09:18:47 PST
*** Bug 371766 has been marked as a duplicate of this bug. ***
Comment 24 Daniel Veditz [:dveditz] 2007-02-27 16:03:32 PST
Comment on attachment 254589 [details] [diff] [review]
Fix the privacy issue.

sr=dveditz
Comment 25 Johnny Stenback (:jst, jst@mozilla.com) 2007-02-27 16:48:02 PST
Privacy issue fixed on the trunk, leaving bug open to track the remaining problem that won't be fixed until bug 221445 is fixed.
Comment 26 Michael Ventnor 2007-03-03 16:41:46 PST
Is there a reason why this is targetted for approval on 2.0.0.4 and not .0.3?
Comment 27 :Gavin Sharp [email: gavin@gavinsharp.com] 2007-03-03 23:15:57 PST
(In reply to comment #26)
> Is there a reason why this is targetted for approval on 2.0.0.4 and not .0.3?

The approval1.8.1.3 flag was renamed to approval1.8.1.4 in preparation for a quicker than usual 1.8.1.3 release for critical bug fixes only.
Comment 28 Daniel Veditz [:dveditz] 2007-03-21 11:06:31 PDT
Comment on attachment 254589 [details] [diff] [review]
Fix the privacy issue.

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for drivers
Comment 29 Johnny Stenback (:jst, jst@mozilla.com) 2007-04-19 18:17:44 PDT
Unmarking the blocking1.9 flag here as the privacy issue here is now fixed. The reminder is not a blocker.

Note You need to log in before you can comment on or make changes to this bug.