550802 - ff pretends having prevented opening of a new window

Status: RESOLVED INCOMPLETE

(Firefox :: General, defect)

Description

[Johannes Falk]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB6

Sometimes a new unwanted window is opened though ff tells that it has successfully prevented the creation of a new window.

Reproducible: Sometimes

Steps to Reproduce:
1. got to some dirty website (e.g. xtube) where shockwave flash is needed
2. though completely blocked with "adblock plus" an advertising window (livejasmin.com) may sometimes be created.
Actual Results:  
An unwanted new window is created that in combination with bug 550795 crashes ff completely.

Expected Results:  
Opening of new windows should never happen, except by the user.

I tried to block livejasmin.com completely with "adblock plus" plugin, but the crash caused by bug 550795 occurs anyway.

Comment 1

[Tyler Downer [He/Him]]

Reporter, are you still seeing this issue with Firefox 3.6.13 or later in safe mode? If not, please close. These links can help you in your testing.
http://support.mozilla.com/kb/Safe+Mode
http://support.mozilla.com/kb/Managing+profiles

You can also try to reproduce in Firefox 4 Beta 8 or later, there are many improvements in the new version, http://www.mozilla.com/en-US/firefox/all-beta.html

Comment 2

[Johannes Falk]

(In reply to comment #1)
> Reporter, are you still seeing this issue with Firefox 3.6.13 or later in safe
> mode? If not, please close.
It seems to be some kind of flash-plugin bug, so safe mode (without plugins) can never show this bug.
Status: ff 3.6.13 still opens the unwanted new window (this always happens only *once* per day or session), but now without saying anything about having prevented this (no message in the top line).

Comment 3

[Tyler Downer [He/Him]]

No reply, INCOMPLETE. Please retest with Firefox 3.6.13 or later and a new profile (http://support.mozilla.com/kb/Managing+profiles). If you continue to see this issue with the newest firefox and a new profile, then please comment on this bug.

Comment 4

[Johannes Falk]

(In reply to comment #3)
> No reply, INCOMPLETE. Please retest with Firefox 3.6.13 or later and a new
> profile (http://support.mozilla.com/kb/Managing+profiles). If you continue to
> see this issue with the newest firefox and a new profile, then please comment
> on this bug.

Tyler, I created a new empty profile and retried the site with the default settings, but the behavior of ff 3.6.13 did not change:
A *new_firefox_window* with unwanted advertising is created every time that site wants to (probably only once every day and this happens on the very first click, before any flash plugin is running).

Comment 5

[Tyler Downer [He/Him]]

What version of flash do you have?
Please go to http://www.bleepingcomputer.com/forums/forum22.html, ask them for help cleaning your computer of malware. Then if this still happens please let us know.

Comment 6

[Johannes Falk]

(In reply to comment #5)
> What version of flash do you have?
> Please go to http://www.bleepingcomputer.com/forums/forum22.html, ask them for
> help cleaning your computer of malware. Then if this still happens please let
> us know.

Of course the latest flash version (adobe about says 10,1,102,64 installed).

I always thought, ff is able to prevent any site from creating new windows.
The primary reason for this report was, that the older ff said in the top line, it has successfully prevented the creation of some new window - but a new window (running some camera flash that crashed my flash, see bug550795
) was opened and put behind the current one. I only got rid of the crash by editing the hosts file to make the other site unreachable by spoofing the resolver.

I do not think that there is any malware on my laptop, because that xtube page does exactly the same thing once every day on all computers I have tested (XP and vista). If I look into their source code with ctrl-U, to me it seems to be some bad trick with window.open() in the function popunder(), that ff can not catch, look what they do:

[...]
var jsm_reruntime = 24; //How many hours before runing again
[...]
function popunder() {
	if(getCookie('popunder') == 1){
	  return true;
	}

	createCookie('popunder',1,jsm_reruntime);
	jsm_url = "http://creatives.livejasmin.com/sizedpop/x/xt/xtube/index.php?psid=ed_ncxtpopg&pstool=147_11192_151&pstour=t1&psprogram=REVS&site=jsm"
	
	if(browser!='chrome'){
		var pu_window=window.open(jsm_url,"","toolbar=1,status=1,resizable=1,scrollbars=1,menubar=1,location=1,directories=0,height=800,width=1100");
		setTimeout(window.focus);
	}
	else{
		var pu_window=window.open(jsm_url,"","scrollbar=yes,height=800,width=1100");
		setTimeout(window.blur);
	}

	if(pu_window) {
		pu_window.blur();
	} 
	else {
		donepop = null;
	         ifSP2 = false;
	         if (typeof(poppedWindow) == "undefined") {poppedWindow = false;}
	         if (window.SymRealWinOpen) {open = SymRealWinOpen;}
	         if (window.NS_ActualOpen) {open = NS_ActualOpen;}
	         ifSP2 = (navigator.userAgent.indexOf("SV1") != - 1);
	         if (!ifSP2) {dopopunder();}
	         else {
	            if(window.Event)
	            document.captureEvents(Event.CLICK);
	            document.onclick = doclickedpopunder;
	         }
	         self.focus();
	         doclickedpopunder();
	      }
}

function dopopunder() {
   if (!poppedWindow) {
      donepop = open(jsm_url, "", "toolbar=1,location=1,directories=0,status=1,menubar=1,scrollbars=1,resizable=1");
      if(donepop) {
         poppedWindow = true;
         self.focus();
      }
   }
}

function doclickedpopunder() {
   if (!poppedWindow) {
      if(!ifSP2) {
         donepop = open(jsm_url, "", "toolbar=1,location=1,directories=0,status=1,menubar=1,scrollbars=1,resizable=1");
         self.focus();
         if(donepop) {poppedWindow = true;}
      }
   }
   if(!poppedWindow) {
      if(window.Event)
      document.captureEvents(Event.CLICK);
      document.onclick = dopopunder;
      self.focus();
   }
}
[...]