Version: 3.3.2 (using KDE KDE 3.3.2) Installed from: Debian testing/unstable Packages OS: Linux I seen a similar but it CLOSED?!! Why? A month ago was broken a function "window.open" in JavaScript. It opened an URLs in SAME window before, like any other browser. Just try this example. ----------------------------------------------------------- <input type=button value='Open Debian' onclick='f1()'><br> <input type=button value='Open KDE' onclick='f2()'><br> <br> <p>And more: it can't operate with opened window:</p> can't close it<br> <input type=button value='Close window' onclick='f3()'><br> ...and can't change URL in it:<br> <input type=button value='Change URL' onclick='f4()'><br> <p>I love Konqueror and want it be perfect!<br><br> <a href='mailto:sergeu@musenko.com'>Sergey V. Musenko</a></p> Versions: Konqueror 3.3.2 on KDE 3.3, Linux Debian Sid, Kernel 2.6.9 <br><br> <script> var w=false; function f1() { w=window.open("http://debian.org", "openSite"); } function f2() { w=window.open("http://kde.org", "openSite"); } function f3() { if( w ) w.close(); else alert('Open it before :)'); } function f4() { if( w ) w.location.href='http://kde-look.org'; else alert('Open it before :)'); } </script>
CVS commit by porten: unbreak calling close() on other windows. It has it own set of security checks. CCBUGS:101178 M +5 -0 ChangeLog 1.386.2.4 M +57 -57 ecma/kjs_window.cpp 1.396.2.2
SVN commit 410258 by porten: allow setting location.href on foreign windows opened by window.open() again. BUGS:101178 M +5 -0 trunk/KDE/kdelibs/khtml/ChangeLog M +7 -3 trunk/KDE/kdelibs/khtml/ecma/kjs_window.cpp --- trunk/KDE/kdelibs/khtml/ChangeLog #410257:410258 @@ -1,3 +1,8 @@ +2005-05-07 Harri Porten <porten@kde.org> + + * ecma/kjs_window.cpp: allow setting location.href on foreign + windows opened by window.open() again (bug #101178). + 2005-05-06 Ivor Hewitt <ivor@ivor.org> fix #15848: First implementation of AdBlocK. --- trunk/KDE/kdelibs/khtml/ecma/kjs_window.cpp #410257:410258 @@ -2135,14 +2135,18 @@ if (m_frame.isNull() || m_frame->m_part.isNull()) return; - // XSS check const Window* window = Window::retrieveWindow( m_frame->m_part ); - if ( !window || !window->isSafeScript(exec) ) + if ( !window ) return; + const HashEntry *entry = Lookup::findEntry(&LocationTable, p); + + // XSS check. Only new hrefs can be set from other sites + if (entry->value != Href && !window->isSafeScript(exec)) + return; + QString str = v.toString(exec).qstring(); KURL url = m_frame->m_part->url(); - const HashEntry *entry = Lookup::findEntry(&LocationTable, p); if (entry) switch (entry->value) { case Href: {
You need to log in before you can comment on or make changes to this bug.
KDE Bug Tracking System
KDE Bug Tracking System 