Closed
Bug 1340634
Opened 8 years ago
Closed 7 years ago
If popups are allowed, pages can freely spawn extra pages (with window.open) when the beforeunload event fires, thus preventing the user from closing the site
Categories
(Core :: DOM: Core & HTML, defect, P3)
Tracking
()
RESOLVED
DUPLICATE
of bug 675574
People
(Reporter: augustolanzarini, Unassigned)
References
(Blocks 1 open bug)
Details
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131
Steps to reproduce:
Estava testando um script em javascript, e acabei descobrindo um bug. Segue o código javascript. Basta criar um arquivo HTML com esse código. Se você marcar para permitir popups, o bug ocorrerá.
<script>
function onunload (){
window.open('logout.php');
}
window.onbeforeunload = function() {
onunload();
return 'You have unsaved changes!';
}
</script>
Actual results:
Após criar o arquivo, acessar a página, e permitir popups, você não conseguira mais fechar a página. Sempre que tentar fechar a página irá abrir outra, mesmo tentando com "Ctrl + W" ou "Alt + F4", até mesmo quando tentar recarregar a página, ele abre uma nova aba. Para acabar, tem que desabilitar o javascript.
Expected results:
O firefox não deveria permitir que o javascript tenha tanto controle(poder).
Comment 1•8 years ago
|
||
This is a known trick that I thought we had a dialog to help users break out of. Probably a dupe of one of the many child bugs of the "eviltraps" bug.
Group: firefox-core-security
Updated•8 years ago
|
Flags: needinfo?(gijskruitbosch+bugs)
Comment 2•8 years ago
|
||
Poor man's (hi google translate) translation of comment #0:
> I was testing a script in javascript, and I discovered a bug. The javascript code follows.
> Just create an HTML file with this code. If you allow popups, the bug will occur.
<script>
function onunload (){
window.open('logout.php');
}
window.onbeforeunload = function() {
onunload();
return 'You have unsaved changes!';
}
</script>
> Actual results:
> After creating the file, accessing the page, and allowing popups, you could no longer close the page.
> Whenever you try to close the page it will open another one, even trying with "Ctrl + W" or "Alt + F4"
> even when trying to reload the page, it opens a new tab. To finish, you have to disable javascript.
>
> Expected results:
> Firefox should not allow javascript to have so much control (power).
Blocks: eviltraps
Flags: needinfo?(gijskruitbosch+bugs)
Summary: páginas infinitas - javascript → If popups are allowed, pages can freely spawn extra pages (with window.open) when the beforeunload event fires, thus preventing the user from closing the site
Comment 3•8 years ago
|
||
User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
I have tested your issue on latest Firefox release v52.0, latest Nightly build (Build ID: 20170316030211) and managed to reproduce it only on Firefox release version. On Firefox v52 whenever you try to close the page it will open another one. On latest Nightly version the page can be closed, but when it is closed another one is opened and that too can be closed.
Can you please retest this using latest Nightly build (https://nightly.mozilla.org/) and report back the results?
Status: UNCONFIRMED → NEW
Component: Untriaged → DOM
Ever confirmed: true
Flags: needinfo?(augustolanzarini)
Product: Firefox → Core
I have tested on Nightly, and I have the same problem. But as they said, if I block the popup, the problem is solved.
I see this as a big problem for normal users, without much knowledge. They will end up rebooting the system to close the browser.
Updated•7 years ago
|
Flags: needinfo?(augustolanzarini)
Priority: -- → P3
Updated•7 years ago
|
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Assignee | ||
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•