345072 - pop-up window closes if using ssl ( opener.top.location.reload() should not be reachable from other domain)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Stephen Clayton]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

Click 'Spectra Webmail' on the left.
This link uses Javascript window.open() to work.  Code has been checked for validity and is o.k.  

This link is supposed to open a pop-up to https://www.spectratechnology.net
Instead the pop-up automatically closes.  

This does not happen with non-SSL pages.  


Reproducible: Always

Steps to Reproduce:
1.  Go to http://www.spectratechnology.com
2.  Click 'Spectra Webmail'.
3.  Pop-up opens and is then automatically closed.

Comment 1

[Martijn Wargers (dead)]

The url doesn't load at all for me, but the popup window isn't closed for me.
Is the ssl site dead, currently?

Comment 2

[Stephen Clayton]

(In reply to comment #1)
> The url doesn't load at all for me, but the popup window isn't closed for me.
> Is the ssl site dead, currently?
> 

server went down.  i am rebooting now and it should be back up within the next 10 minutes.

Comment 3

[Martijn Wargers (dead)]

Ok, this happens because of this script:
            if(window.opener)
            {
                window.opener.top.location.reload();
                window.close();
            }
            
            window.top.location.target="_top";
            if(window.location.target != "_top")
              window.top.location.href = window.location.href;

window.opener.top.location.reload() is working in Mozilla for other domains, while it isn't working in IE6.
I'd rather see that scripts from the popup from a different domain weren't able at all to access the location object from the opener window, but I guess that's a compatibility thing with IE6, see bug 56053.

Testcase here:
http://wargers.org/mozilla/bug345072/345072_win_open_ssl.htm

so the solution would be to be also compatible with the IE6 case here and refuse location.reload() access from different domains.

Comment 4

[Martijn Wargers (dead)]

Attachment: patch

Something like this?
This is more or less copied code from bug 197305.

Comment 5

[Boris Zbarsky [:bzbarsky]]

So wait.  You can't location.reload() cross-domain in IE?  If so, we should just remove http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/modules/libpref/src/init/all.js&rev=3.653&mark=286#286 and be done with it.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Specifically, if I open a window like so:

 var win = window.open('http://some-other-domain');

in IE and wait for that to load, can I call win.location.reload()?

Comment 7

[Martijn Wargers (dead)]

Attachment: testcase

(In reply to comment #6)
> Specifically, if I open a window like so:
> 
>  var win = window.open('http://some-other-domain');
> 
> in IE and wait for that to load, can I call win.location.reload()?

No, you can't, that gives a script error in IE6 (at least in my IE6).

Comment 8

[Martijn Wargers (dead)]

Attachment: patch as Boris indicated in comment 5

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 232178 [details] [diff] [review]
patch as Boris indicated in comment 5

I'd like jst to look over this too...

And I think we should at least take this on the 1.8 branch.

Comment 10

[Johnny Stenback (:jst)]

Comment on attachment 232178 [details] [diff] [review]
patch as Boris indicated in comment 5

r=jst

Comment 11

[Robert Sayre]

/cvsroot/mozilla/modules/libpref/src/init/all.js,v  <--  all.js
new revision: 3.657; previous revision: 3.656
done

Comment 12

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 232178 [details] [diff] [review]
patch as Boris indicated in comment 5

a=beltzner on behalf of drivers for the mozilla_1_8_branch

Comment 13

[Martijn Wargers (dead)]

Checking in all.js;
/cvsroot/mozilla/modules/libpref/src/init/all.js,v  <--  all.js
new revision: 3.585.2.50; previous revision: 3.585.2.49
done

Checked into the 1.8.1 branch.