364146 - Pop-up can sometimes be opened by clicking on page content

Status: RESOLVED WORKSFORME

(Camino Graveyard :: Annoyance Blocking, defect)

Description

[froodian (Ian Leue)]

I've noticed this occasionally for a while, but thought I must be hallucinating.  It's not 100% reproable, but when it is it's very nasty, and defeats the whole point of pop-up blocking.  STR:

1. Navigate to a page with a pop-up (possibly only from the location bar or a link from an external app?).  I haven't yet determined whether this is only specific pop-up pages, or particular ones.  I've seen it happen several times with the one in the URL field.
2. Try to scroll up and down using the arrow keys.  If nothing happens, you've triggered the bug.
3. Click on an empty space in the content pane.

What happens: Pop-up opens! Evil.
What should happen:  It stays safely locked away.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I've occasionally had pop-ups triggered by hitting the spacebar to page down on pages (at imagevenue or whatever it's called, one of those imagehost sites).  I've also sometimes seen a popup after clicking the "Vote" button at JoyofTech....

Comment 2

[Stuart Morgan]

(In reply to comment #1)
> I've also sometimes seen a popup after clicking the "Vote" button at
> JoyofTech....

Unless things have change, popups that are the direct result of user interaction with page elements aren't blocked, since they are assumed to be intentional/desired, and blocking them breaks a lot of things.

Comment 3

[philippe (part-time)]

It didn't happen for me on that page, but I've seen it once on a French IT site.
It is the new trick: body onclick="show evil pop up" (or onkeypress="", which is even worse). Often they hide that in the JS somewhere.

Comment 4

[Chris Lawson (gone)]

There isn't any reasonable way to know when an onclick or onkeypress handler is going to do something evil vs. something useful, though, so I don't see how there's any way to fix this (and certainly not at the Camino level; seems like it would be Core's popup blocker if anything). :(

cl

Comment 5

[Chris Lawson (gone)]

If someone finds a reproducible testcase (clearing cookies will probably be involved in reproducing it), this should probably be re-filed against Core's popup blocker (probably as an enhancement request, since it seems there's an element of user interaction involved here and Core has traditionally not blocked popups triggered by interaction with the page). I'm gonna close this as WORKSFORME since the specific URL given here didn't always trigger it.