622763 - Wrong tab can capture some key shortcuts, effects of some key shortcuts unpredictable

Status: RESOLVED INVALID

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Olle Bergkvist]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/8.04 (hardy) Firefox/3.6.13
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/8.04 (hardy) Firefox/3.6.13

Ok, this is going to get messy, but I hope you'll read to the end. I'm an experienced user and this is a real, potentially serious, problem. 

Background:

The web application Outlook Web App (OWA), located at http://outlook.com uses keyboard shortcuts for various actions. One of these is Ctrl-N, to open a pop-up with a new empty message. There are several other shortcuts as well, and this bug *probably* generalizes for them as well. I do not know exactly what the javascript performs to capture these keystrokes, but hopefully I will find that soon. 

The problem: 

Usually, Ctrl-Shift-N opens a new freash window. This applies both in OWA and in other tabs. 

However, after navigating to OWA, and using Ctrl-N to open the composer pop-up, closing the pop-up, and then from OWA pressing Ctrl-Shift-N, Firefox doesn't open a new freash browser window. Instead, the OWA shortcut is fired and the composer pop-up in opened! 

When I switch to another tab, and then press Ctrl-Shift-N again, OWA captures this keystroke as well, despite being the wrong tab! The composer is opened. A new fresh window is not opened. 


Reproducible: Always

Steps to Reproduce:
1. Log in to OWA. 
2. Ctrl-N
3. Close the pop-up. 
4. Switch to another tab. 
5. Ctrl-Shift-N.

Actual Results:  
A) The composer pop-up is opened, despite OWA being in an inactive tab. 

B) The Ctrl-Shift-N keystroke produces different result depending on whether Ctrl-N was last used within OWA or within another tab. 


Expected Results:  
A) The OWA tab should not get the Ctrl-Shift-N keystroke when another tab is focused. 

B) The Ctrl-Shift-N keystroke should produce the same result no matter whether Ctrl-N was last used within OWA or within another tab. 


I understand that this affects a minimal number of users, but because of the potential security risk if this bug can be exploited in other more general ways, I selected Major severity.

Comment 1

[Olle Bergkvist]

Some kind of table to sum up... Not sure if it helps or not. 

            2. Where is focus now? --> ||  in OWA            ||   in other tab
1. What was done last? 
CN used to open New Window -->    ||  CSN = New Window   || CSN = New Window
CN used to open OWA composer -->  ||  CSN = OWA Composer || CSN = OWA Composer

    in either case                    || CN = OWA Composer   || CN = New Window
where
CN = Ctrl-N
CSN = Ctrl-Shift-N

Comment 2

[Benjamin Smedberg]

Do you need an OWA account to reproduce the problem?

Comment 3

[Brandon Sterne (:bsterne)]

OWA appears to only be available to EDUs and MSFT employees:
http://outlookliveanswers.com/forums/t/972.aspx

Comment 4

[Olle Bergkvist]

(In reply to comment #2)
> Do you need an OWA account to reproduce the problem?

Yes/no. As of right now, I can't get this to work with anything else than Ctrl-N in OWA. But it should be possible to build a sample HTML webpage with Javascript that does the same thing, and for other key combinations. 

I tried to look into their Javascript to isolate the problem, but it's heavily obscured and difficult to understand. 

(In reply to comment #3)
> OWA appears to only be available to EDUs and MSFT employees:
> http://outlookliveanswers.com/forums/t/972.aspx

That's what I expected. :(

Comment 5

[Olle Bergkvist]

I've now sent a question to Microsoft support. I don't expect any useful reply, but they could surprise me.

Comment 6

[Olle Bergkvist]

I have generated linebreaks and indentation for the javascripts. Anyone who wants to take a look? Maybe I should upload them here, though I think that would be a bit illegal, right?

Comment 7

[Olle Bergkvist]

This might just be the normal behaviour for Ctrl-Shift-N. (Open the last window, which happens to be the Composer window.) Sorry.