Closed Bug 40850 Opened 25 years ago Closed 25 years ago

Open titlebar-less windows from javascript

Categories

(Core :: DOM: Core & HTML, defect, P3)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: stric, Assigned: danm.moz)

References

(
URL
)

Details

I consider it very bad to let websites to open titlebar-less windows at any size. The casual user might not spot them and run into trouble of different sorts.
DOM level 0, not JS engine. /be
Assignee: rogerl → jst
Status: UNCONFIRMED → NEW
Component: Javascript Engine → DOM Level 0
Ever confirmed: true
Agreed, this is dangerous. 4.x puts a series of size and titlebar restrictions on JS-created windows, these need to be reimplemented. See http:// developer.netscape.com/docs/manuals/communicator/jssec/contents.htm#1024666 for the old policy.
Reassigning to danm, who works on window related issues.
Really reassigning this time
Assignee: jst → danm
Absolutely. joki is holding onto a patch to fix a bunch of similar security problems. I'll get him to add this to his patch, or add this after he checks in what he has.
Status: NEW → ASSIGNED
*** Bug 35143 has been marked as a duplicate of this bug. ***
joki recently made titlebar removal dependent on the UniversalBrowserWrite capability. By which I mean to say, this is fixed.
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.