Closed Bug 383382 Opened 18 years ago Closed 12 years ago

alerts can appear over the wrong window

Categories

(Core :: DOM: Core & HTML, defect)

x86
Linux
defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: mrbkap, Unassigned)

Details

(Keywords: sec-low, Whiteboard: [sg:low spoof])

Attachments

(1 file)

Attached file testcase
We've done some work in the past to ensure that alerts always appear over the page that called alert. However, by using |alert(window.open(...) && "foo")| it's possible to get around the current fixes.
Whiteboard: [sg:low spoof]
The original fix to bring the alert()ing tab to the foreground was for bug 262887.
Jesse asked some pointed questions that led to the following conclusions: - The window.open call does not have to be *in* the call to alert. So: window.open("http://www.mozilla.org"); alert("Hello, world"); shows the same behavior. - The testcase works on Linux whether or not you divert new windows to tabs. - The testcase only works on Windows if you divert new windows to tabs.
Dolske, is this still valid? What are the cases where alert() still produces a dialog?
Because we have now per tab alerts, this is wfm.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Group: core-security → core-security-release
Group: core-security-release
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: