Re: trying to close a window and open a new one without toolbars

From: DU (drunclear_at_hotNOSPAMmail.com)
Date: 09/29/04


Date: Wed, 29 Sep 2004 16:41:21 -0400

Albretch wrote:

>
> I said, I will/need to:
>

Did you really need to post this to a java programming newsgroup? Has
your post anything to do with java actually?

> 1) open an initial window via target="_new",
>

target="_new" is already invalid markup code.
"Except for the reserved names listed below, frame target names must
begin with an alphabetic character (a-zA-Z). User agents should ignore
all other target names."
http://www.w3.org/TR/html401/types.html#type-frame-target

> which would then

You can not force this in NS 7.x and Mozilla-based browsers:
user_pref("browser.block.target_new_window", true);

Even HTML 4.01 Technical Recommendation clearly indicate that user
agents can bypass and override target="_blank" calls:

"User agents may provide users with a mechanism to override the target
attribute."
http://www.w3.org/TR/html401/present/frames.html#h-16.3.2

> 2) open a window from 1 which will not have toolbars and
>

Automatically opening an unrequested window will be filtered, prevented,
suppressed by a very wide majority of modern browsers nowadays:
NS 7.x, MSIE 6 SP2, Opera 7.x, K-meleon 0.8+, Galeon 1.x, Konqueror 3.x,
Safari 1.x, etc.. not to mention all kinds of 3rd parties add-ons,
browser extensions, etc.

You can not force Opera 7.x, Mozilla-based browsers to suppress
toolbars: that is just impossible to force.

user_pref("dom.disable_window_open_feature.toolbar", true);
user_pref("dom.disable_window_open_feature.location", true);
user_pref("dom.disable_window_open_feature.personalbar", true);
user_pref("dom.disable_window_open_feature.menubar", true);
user_pref("dom.disable_window_open_feature.scrollbars", true);
user_pref("dom.disable_window_open_feature.resizable", true);
user_pref("dom.disable_window_open_feature.minimizable", true);
user_pref("dom.disable_window_open_feature.status", true);

Since windows XP SP2 release, web developers can not remove by force
statusbar from new secondary windows.

> 3) would close 1
>

You can't even force that in Mozilla-based browsers either:
user_pref("dom.allow_scripts_to_close_windows", true);

while there are bugs filed for forcing scripts closing windows with a
cheap js window.opener trick in MSIE 7 and Opera 7: security is now
important you see.

> I wonder how/why would this change the world as we know it.

Removing statusbar is removing the toolbar by which users can see http
connections, transfers, loading notifications, security (SSL) padlock
icon status: why would you (or your clients) need to remove such toolbar
from the users' browsers? Did you know that some security hacks were
successful because users could not see the difference (different urls)
between what was written in the statusbar and what was in the
locationbar? So, why would you (or your clients) want to remove both the
statusbar and locationbar on the users' browsers?

Why would leaving these toolbars present change anything for your own
security, your own personal info, your own sensitive info? If you or
your clients can not understand the users' perspective, then just put
and leave your credit card numbers, personal identifications, phone
numbers, etc.. on a webpage for a few days.

DU

-- 
The site said to use Internet Explorer 5 or better... so I switched to 
Mozilla 1.7.3 :)


Relevant Pages

  • [TOOL] HTML Manglizer - Automatically Check For HTML Parsing Flaws
    ... Get your security news from a reliable source. ... All browsers but Microsoft Internet Explorer kept crashing on a regular ... basis due to NULL pointer references, memory corruption, buffer overflows, ... A gallery of quick examples I examined to locate the offending tag (total ...
    (Securiteam)
  • RE: [Full-Disclosure] Microsoft and Security
    ... Some large sites are written only for late model IEs. ... They play to the user who has ... browsers, and those that used text based browsers, a cliet could browse ... Of course, security companiees, though advocating that active c0ntent not ...
    (Full-Disclosure)
  • Re: To Anyone who has Internet Explorer Installed or any other browser (Everybody)
    ... > patch the affected versions. ... the article doesn't say that Microsoft has had ample warning. ... versions of the browsers!" ... >>the context of the local zone, and a patch which fixes security ...
    (alt.computer.security)
  • Re: why do iceweasel et al have more frequent security issues?
    ... > requiring updates far more frequently than other browsers like Konqueror ... the more lucrative is it to find security holes and damage ... desktop environment session as root, which, if more people did, ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". ...
    (Debian-User)
  • Re: Bass Burhglar Alarms
    ... We all know everything you are posting. ... The newsgroup stuck pretty much to topic. ... I should tell you to enable security alerts on your web ... >> My browsers all show my pages without any ...
    (alt.security.alarms)