658911 - A forbidden popup window appeared

Status: RESOLVED WONTFIX

(Core :: DOM: Navigation, defect)

Description

[Nicolas Barbulesco]

User-Agent:       Mozilla/5.0 (Windows NT 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

My options are set to block popups and not to allow the 3 available Javascript wrongdoings.

On top of that, I have set the about:config option to open links in the current tab. Which, first, should not be such a hidden option — apparently it was a visible one in some previous Firefox — and, secondly, should be the default behaviour.

So no popup window must ever come to life.

I encountered a popup window.

This is unacceptable.

Please make Firefox more pleasant to use by fixing this behaviour.

Thanks,

Nicolas Barbulesco


Reproducible: Always

Steps to Reproduce:
1. Go to http://sergebrussolo.free.fr .
2. Click on "Le Masque d'argile".


Actual Results:  
A popup window jumped.


Expected Results:  
See in "Details".


Firefox 4.0.1 Windows.

Comment 2

[:aceman]

I do not think the "popup protection" is designed to block also popup windows generated by user action, e.g. button clicks. I think it only blocks windows created automatically without user interaction.

You can see the button is a link to javascript to open a new window. You still click it, so you want the window, it is crucial part of the page content.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Indeed.  This is working as it should.  If you click a button whose onclick handler uses window.open(), then a new window will be opened.

Comment 5

[Nicolas Barbulesco]

No.

First, that is not what the Options proudly say: "Block popup windows", Exceptions: No.

Secondly, we all know that sites use this flaw to simulate a user-demanded call which triggers popup window. Spend years and years improving checking to be as sure as possible that the user has really demanded the call, the sites will exploit the flaw.

Thirdly, this is not what I want. For security and against disruption, my click in a tab must generate another tab only when I demand so.

IE 8 does it better. When I click, he displays the yellow bar. If I want to see the popup window that has been blocked, then I click on the yellow bar and then things get complicated for IE; for I-forgot-which-browser, they are simple: I choose the popup window in the yellow menu, and it shows. Shows where? This is another story.

Comment 6

[:aceman]

FF popup protection is designed only to protect against windows that open even without you clicking anything. If you wish to have an option to also block windows initiated by user clicks (but surely only on some sites) then please open a new bug describing this wish and mark it enhancement (feature request) in the "importance" field.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Your issue is that your definition of "popup window" differs from most people's.  Most people classify auto-opening windows as "popups" while windows that open in response to them doing something are just windows.

Comment 8

[:aceman]

Filed enhancement as bug 660308.

Comment 9

[Nicolas Barbulesco]

(In reply to comment #7)

> Your issue is that your definition of "popup window" differs from most
> people's.  Most people classify auto-opening windows as "popups" while
> windows that open in response to them doing something are just windows.

No.

Both of these are called "popup window", "jumping window", "springing window" - I think about English, French and German.

There are the "automatic popup window", which appears without click. I want it not to appear, like all users.

And there are the "popup window triggered by user action". Some users are OK with it. Some users, like me, don't want it to appear without some yellow-bar-style authorization.

Comment 10

[Nicolas Barbulesco]

(In reply to comment #7)

> Your issue is that your definition of "popup window" differs from most
> people's.  Most people classify auto-opening windows as "popups" while
> windows that open in response to them doing something are just windows.

Anyway, some thing jumping badly to me and just called "Windows" does not trigger in me very favourable feelings. ;-)

Comment 11

[Nicolas Barbulesco]

> Indeed.  This is working as it should.  If you click a button whose
> onclick
> handler uses window.open(), then a new window will be opened.

In this case, the browser obeys too much the page and does not put enough the user in control. Which is, according to my sensitivity and to usability literature, very bad.

IE 8 does not that. Instead, it displays the yellow bar, in order to allow the user to show the blocked page if he really wants to. Which is a much better behaviour.

> Secondly, we all know that sites use this flaw to simulate a
> user-demanded
> call which triggers popup window. Spend years and years improving
> checking
> to be as sure as possible that the user has really demanded the
> call, the
> sites will exploit the flaw.

Nowadays the Web is even full of this trap, luring the user into demanding the call, although this is not at all what he wants:

The user is attracted to the trap by a legitimate-appearing bait. The ad on a page shows a - sometimes fake - "Close" link or cross. I click on it to close the ad, and that click triggers a popup window! I just saw a popup window opening in Firefox because of that trick.

> FF popup protection is designed only to protect against windows that
> open even without you clicking anything.

In that case, that's not what Firefox advertises, and that's really not enough protection.

Some "protection feature" should not even be needed. Web browsers have evolved in the wrong way. They have included all kind of flaws: Javascript, "target" attribute... And now they are building stronger and stronger "blockers" around them. A much simpler and safer design would be: not to provide to the page any way to interact out of its frame, except in a few specific cases, safely handled and user-controlled.

Let's continue the discussion on Bug 660308. :-)

Comment 12

[:aceman]

Please copy this reasoning to bug 660308 which I have created for this purpose.

Comment 13

[Nicolas Barbulesco]

I just did, and now I see your suggestion Aceman. Great minds think alike. :-)

Comment 17

[t8av]

(In reply to aceman from comment #2)
> I do not think the "popup protection" is designed to block also popup
> windows generated by user action, e.g. button clicks. I think it only blocks
> windows created automatically without user interaction.
> 
> You can see the button is a link to javascript to open a new window. You
> still click it, so you want the window, it is crucial part of the page
> content.

See Bug 648728 - Pop up blocker does not work for website ynet.co.il. The popup window is activated when the user is clicking an ordinary text (not a link, not a button).

Comment 18

[t8av]

Actually this behavior is two different bugs:

1. Clicking a simple text opens a new window with ads, as already mentioned.

2. Firefox setup "Open new windows in a new tab instead" is being ignored by the browser. The annoying popup ads are being opened in a new window. Why does not firefox open them, at least, in a new tab, so it will be easier to close them immediately after they appear?

Comment 19

[t8av]

Why is this bug closed???

Nothing was fixed.

See Bug 648728 - Pop up blocker does not work for website ynet.co.il. The popup window is activated when the user is clicking an ordinary text (not a link, not a button).

Comment 20

[Nicolas Barbulesco]

(In reply to t8av from comment #19)

> Why is this bug closed???
> 
> Nothing was fixed.
> 
> See Bug 648728 - Pop up blocker does not work for website ynet.co.il. The
> popup window is activated when the user is clicking an ordinary text (not a
> link, not a button).

Indeed. This issue is not invalid. I am marking it "WONTFIX". Seemingly the people of Firefox don't want to fix it. I would be happy to be wrong.