Closed Bug 601031 Opened 14 years ago Closed 14 years ago

Should we disable autofocus when script is disabled?

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: mounir, Assigned: mounir)

References

Details

I personally doubt that's a good idea even more considering user can disable autofocus. The option to disable autofocus could be removed if we want to disable autofocus when script is disabled.
We shouldn't. Not requiring scripting to be enabled is one of the main points of autofocus.
(In reply to comment #1) > We shouldn't. Not requiring scripting to be enabled is one of the main points > of autofocus. I agree but sicking doesn't, claiming there is a security treat for people using autofocus which is not acceptable if they have disabled script (considering that's often done for security reasons).
I don't want people to feel that we have provided them with a pref to turn of scripting, and then we inject a different way of doing script-like things and which doesn't honor the pref. Not requiring authors to use scripting was one of the goals I agree. Being able to use autofocus for users that have disabled scripts was not a goal as far as I am aware.
Also note that there is only a very small number of users that disable javascript. So disabling autofocus here does not affect the vast majority of users in any way. Also, the people who turn off scripting is probably the same group of people who doesn't want the browser to mess around with their focus.
(In reply to comment #4) > Also, the people who turn off scripting is probably the same group of people > who doesn't want the browser to mess around with their focus. As a user disabling javascript, I have no problem with autofocus being enabled by default. And if it happens to bother me, I can disable autofocus in about:config. I think we should try to have bug 601030 fixing most obvious possible issues with focus stealing and let autofocus being enabled by default. By the way, we could point the new option to noscript extension which might add a checkbox in their UI to disable autofocus. I would bet that most users disabling scripts in Firefox do that via noscript.
(In reply to comment #4) > Also note that there is only a very small number of users that disable > javascript. So disabling autofocus here does not affect the vast majority of > users in any way. But maybe it affects a minority that can influence/decide on more people. > Also, the people who turn off scripting is probably the same group of people > who doesn't want the browser to mess around with their focus. I have turned off scripting and I always have seen the HTML5 input features as the possibility to design and use sites without JS. But I can understand the point that these new features may bring up some security implications. I would suggest to create a new category for elements of HTML5 and maybe CSS3 that might cause problems, so the user can disable these features.
If there are features that could cause problems, we should fix those problems rather than adding even more untested pref-governed branches to our code.
Are you suggesting we disable scripts since some people think it's too troublesome?
I think we should try to fix bug 601030 then we will see what could still be a security issue with this feature. If there is no, I think we should just keep it enabled by default and not assume that people who disable scripts want it to be disabled.
Depends on: 601030
Jonas, would you be fine to mark this bug WONTFIX given that bug 601030 seems to be in a good path to be fixed?
I guess I'm not religious about fixing this bug. As long as we have a separate pref for disabling autofocus? (We usually do for *any* new feature, as a safty measure if there is any bugs in the implementation or any security aspects that we've missed)
(In reply to comment #11) > I guess I'm not religious about fixing this bug. As long as we have a separate > pref for disabling autofocus? We do. I'm marking this bug WONTFIX then.
Assignee: nobody → mounir.lamouri
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.