65930 - Access denied exception thrown when loading popup images.

Status: RESOLVED INCOMPLETE

(Core :: Security, defect, P3)

Description

[Johnny Stenback (:jst)]

Loading the above URL works just fine on Win2k for me, I can click on one of the
camera icons in the table and I get a new window that shows an image, if I try
the same thing on linux I get access denied errors on the console and no image
is loaded into the popup window. I see this when using a linux build from a few
days ago.

Comment 1

[Gilles Durys]

wfm build 2001011821

Comment 2

[Mitchell Stoltz (not reading bugmail)]

I'll take a look. Worksforme on NT, I'll try Linux.

Comment 3

[Johnny Stenback (:jst)]

Mitchell, Phil Schwartau sez in bug 57896 that he sees the ACCESS_DENIED
exception on linux on this URL too.

Comment 4

[Martin Jacobs]

Omitted document.open("text/html","replace"); 
Restored.  Please retry.  

Comment 5

[Phil Schwartau]

OK, now it works fine on Linux as well as WinNT. Marking WORKSFORME.

Does anyone know why the error Martin mentions above would cause the 
site to fail on Linux, but not on WinNT? That's still a mystery to me - 

Comment 6

[Martin Jacobs]

So called "javascript guru" tells everyone on the net not to use 
window.document.open(), as it's implied by window.document.write().  
Never trust gurus.  
There's now another problem I can see : body onload event.  
Where is it best reported ?  

Comment 7

[Johnny Stenback (:jst)]

Martin, could you attach a simplified version of the HTML (or put up a version
on the site) that still shows the ACCESS_DENIED problem? There's clearly a bug
somewhere in our code since we're seeing a difference between platforms. Wether
or not you do document.open() or not shouldn't really matter and we should
figure out why this happens and fix it. Reopening.

Comment 8

[Martin Jacobs]

On body-onload, occas.html is location.replace()d by actual page, occasbe.html. 
Very difficult to simplify and reduce as this is a client-side dynamic page with 
3 js files (data, page editor and pop-up driver).  
On win95, works fine with NN4 and IE4-5.  
But there's clearly a problem with M0.7 as occasbe.html body-onload doesn't fire 
next time page loaded (top-left white claws should move down).  

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestones to Moz0.9.1. Many of these bugs are dependent on the
XPConnected DOM and its associated security UI changes.

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.5, Priority P2.

Comment 11

[Mitchell Stoltz (not reading bugmail)]

time marches on. Retargeting to 0.9.6.

Comment 12

[Mitchell Stoltz (not reading bugmail)]

Moving the most time-critical bugs and minor security fixes to 0.9.7

Comment 13

[Mitchell Stoltz (not reading bugmail)]

Futuring.

Comment 14

[Sylvestre Ledru [:Sylvestre]]

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information

Comment 15

[u597032]

Page no longer active