[giow] (2) window.open() should block popups too.

Fixing http://www.w3.org/Bugs/Public/show_bug.cgi?id=13894 git-svn-id: http://svn.whatwg.org/webapps@6679 340c8d12-0b0e-0410-8428-c7bf67bfef74
whatwg · Oct 13, 2011 · aee8486 · aee8486
1 parent 5df7dea
commit aee8486
Show file tree

Hide file tree

Showing 3 changed files with 90 additions and 19 deletions.
diff --git a/complete.html b/complete.html
@@ -240,7 +240,7 @@
 
   <header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
    <hgroup><h1 class=allcaps>HTML</h1>
-    <h2 class="no-num no-toc">Living Standard &mdash; Last Updated 12 October 2011</h2>
+    <h2 class="no-num no-toc">Living Standard &mdash; Last Updated 13 October 2011</h2>
    </hgroup><dl><dt><strong>Web developer edition:</strong></dt>
     <dd><strong><a href=http://developers.whatwg.org/>http://developers.whatwg.org/</a></strong></dd>
     <dt>Multiple-page version:</dt>
@@ -19587,10 +19587,8 @@ <h4 id=the-a-element><span class=secno>4.6.1 </span>The <dfn><code>a</code></dfn
   that create <a href=#hyperlink title=hyperlink>hyperlinks</a> is to run the
   following steps:</p>
 
-  <ol><li><p>If the <code title=event-click><a href=#event-click>click</a></code> event in
-   question is not <a href=#concept-events-trusted title=concept-events-trusted>trusted</a>
-   (i.e. a <code title=dom-click><a href=#dom-click>click()</a></code> method call was the
-   reason for the event being dispatched), and either the <code><a href=#the-a-element>a</a></code>
+  <ol><li><p>If the algorithm is not <a href=#allowed-to-show-a-pop-up>allowed to show a
+   pop-up</a> and either the <code><a href=#the-a-element>a</a></code>
 <!--DOWNLOAD-->
    element has a <code title=attr-hyperlink-download><a href=#attr-hyperlink-download>download</a></code> attribute or the
 <!--DOWNLOAD-->
@@ -54930,6 +54928,8 @@ <h4 id=links-created-by-a-and-area-elements><span class=secno>4.12.2 </span>Link
 
   <h4 id=following-hyperlinks-0><span class=secno>4.12.3 </span>Following hyperlinks</h4>
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>When a user <dfn id=following-hyperlinks title="following hyperlinks">follows a
   hyperlink</dfn> created by an element, the user agent must <a href=#resolve-a-url title="resolve a url">resolve</a> the <a href=#url>URL</a> given by
   the <code title=attr-hyperlink-href><a href=#attr-hyperlink-href>href</a></code> attribute of that
@@ -62213,7 +62213,18 @@ <h4 id=browsing-context-names><span class=secno>6.1.6 </span>Browsing context na
 
   <div class=impl>
 
-  <p><dfn id=the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>The rules for choosing a browsing context given a browsing
+  <hr><p>An algorithm is <dfn id=allowed-to-show-a-pop-up>allowed to show a pop-up</dfn> if:
+
+  <ul class=brief><li>it is running in the context of an <a href=#activation-behavior>activation
+   behavior</a> or of the <a href=#concept-event-dispatch title=concept-event-dispatch>dispatching</a> of a <code title=event-click><a href=#event-click>click</a></code> event, and</li>
+
+   <li>The <code title=event-click><a href=#event-click>click</a></code> event that led to
+   the triggering of the <a href=#activation-behavior>activation behavior</a>, if any, and
+   <code title=event-click><a href=#event-click>click</a></code> events of any the <a href=#concept-event-dispatch title=concept-event-dispatch>event dispatching</a> that
+   indirectly led to the algorithm being invoked, if any, are all
+   <a href=#concept-events-trusted title=concept-events-trusted>trusted</a>.</li>
+
+  </ul><hr><p><dfn id=the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>The rules for choosing a browsing context given a browsing
   context name</dfn> are as follows. The rules assume that they are
   being applied in the context of a <a href=#browsing-context>browsing context</a>.</p>
 
@@ -62601,6 +62612,8 @@ <h4 id=apis-for-creating-and-navigating-browsing-contexts-by-name><span class=se
 
   </dl><div class=impl>
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>The <dfn id=dom-open title=dom-open><code>open()</code></dfn> method on
   <code><a href=#window>Window</a></code> objects provides a mechanism for <a href=#navigate title=navigate>navigating</a> an existing <a href=#browsing-context>browsing
   context</a> or opening and navigating an <a href=#auxiliary-browsing-context>auxiliary browsing
@@ -62655,7 +62668,14 @@ <h4 id=apis-for-creating-and-navigating-browsing-contexts-by-name><span class=se
   agent could override the selection of the target browsing context to
   instead target a new tab.</p>
 
-  <p>Then, if <var title="">url</var> is not
+  <p>If the method is not <a href=#allowed-to-show-a-pop-up>allowed to show a pop-up</a> and
+  applying <a href=#the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>the rules for choosing a browsing context given a
+  browsing context name</a> using the <var title="">target</var>
+  argument, would result in there not being a chosen browsing context,
+  then throw an <code><a href=#invalidaccesserror>InvalidAccessError</a></code> exception and abort
+  these steps.</p>
+
+  <p>Otherwise, if <var title="">url</var> is not
   "<code><a href=#about:blank>about:blank</a></code>", the user agent must
   <a href=#navigate>navigate</a><!--DONAV window.open()--> the selected
   <a href=#browsing-context>browsing context</a> to the <a href=#absolute-url>absolute URL</a> (or

diff --git a/index b/index
@@ -240,7 +240,7 @@
 
   <header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
    <hgroup><h1 class=allcaps>HTML</h1>
-    <h2 class="no-num no-toc">Living Standard &mdash; Last Updated 12 October 2011</h2>
+    <h2 class="no-num no-toc">Living Standard &mdash; Last Updated 13 October 2011</h2>
    </hgroup><dl><dt><strong>Web developer edition:</strong></dt>
     <dd><strong><a href=http://developers.whatwg.org/>http://developers.whatwg.org/</a></strong></dd>
     <dt>Multiple-page version:</dt>
@@ -19587,10 +19587,8 @@ included with Exhibit B.
   that create <a href=#hyperlink title=hyperlink>hyperlinks</a> is to run the
   following steps:</p>
 
-  <ol><li><p>If the <code title=event-click><a href=#event-click>click</a></code> event in
-   question is not <a href=#concept-events-trusted title=concept-events-trusted>trusted</a>
-   (i.e. a <code title=dom-click><a href=#dom-click>click()</a></code> method call was the
-   reason for the event being dispatched), and either the <code><a href=#the-a-element>a</a></code>
+  <ol><li><p>If the algorithm is not <a href=#allowed-to-show-a-pop-up>allowed to show a
+   pop-up</a> and either the <code><a href=#the-a-element>a</a></code>
 <!--DOWNLOAD-->
    element has a <code title=attr-hyperlink-download><a href=#attr-hyperlink-download>download</a></code> attribute or the
 <!--DOWNLOAD-->
@@ -54930,6 +54928,8 @@ fur
 
   <h4 id=following-hyperlinks-0><span class=secno>4.12.3 </span>Following hyperlinks</h4>
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>When a user <dfn id=following-hyperlinks title="following hyperlinks">follows a
   hyperlink</dfn> created by an element, the user agent must <a href=#resolve-a-url title="resolve a url">resolve</a> the <a href=#url>URL</a> given by
   the <code title=attr-hyperlink-href><a href=#attr-hyperlink-href>href</a></code> attribute of that
@@ -62213,7 +62213,18 @@ END:VCARD</pre>
 
   <div class=impl>
 
-  <p><dfn id=the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>The rules for choosing a browsing context given a browsing
+  <hr><p>An algorithm is <dfn id=allowed-to-show-a-pop-up>allowed to show a pop-up</dfn> if:
+
+  <ul class=brief><li>it is running in the context of an <a href=#activation-behavior>activation
+   behavior</a> or of the <a href=#concept-event-dispatch title=concept-event-dispatch>dispatching</a> of a <code title=event-click><a href=#event-click>click</a></code> event, and</li>
+
+   <li>The <code title=event-click><a href=#event-click>click</a></code> event that led to
+   the triggering of the <a href=#activation-behavior>activation behavior</a>, if any, and
+   <code title=event-click><a href=#event-click>click</a></code> events of any the <a href=#concept-event-dispatch title=concept-event-dispatch>event dispatching</a> that
+   indirectly led to the algorithm being invoked, if any, are all
+   <a href=#concept-events-trusted title=concept-events-trusted>trusted</a>.</li>
+
+  </ul><hr><p><dfn id=the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>The rules for choosing a browsing context given a browsing
   context name</dfn> are as follows. The rules assume that they are
   being applied in the context of a <a href=#browsing-context>browsing context</a>.</p>
 
@@ -62601,6 +62612,8 @@ interface <dfn id=window>Window</dfn> : <a href=#eventtarget>EventTarget</a> {
 
   </dl><div class=impl>
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>The <dfn id=dom-open title=dom-open><code>open()</code></dfn> method on
   <code><a href=#window>Window</a></code> objects provides a mechanism for <a href=#navigate title=navigate>navigating</a> an existing <a href=#browsing-context>browsing
   context</a> or opening and navigating an <a href=#auxiliary-browsing-context>auxiliary browsing
@@ -62655,7 +62668,14 @@ interface <dfn id=window>Window</dfn> : <a href=#eventtarget>EventTarget</a> {
   agent could override the selection of the target browsing context to
   instead target a new tab.</p>
 
-  <p>Then, if <var title="">url</var> is not
+  <p>If the method is not <a href=#allowed-to-show-a-pop-up>allowed to show a pop-up</a> and
+  applying <a href=#the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name>the rules for choosing a browsing context given a
+  browsing context name</a> using the <var title="">target</var>
+  argument, would result in there not being a chosen browsing context,
+  then throw an <code><a href=#invalidaccesserror>InvalidAccessError</a></code> exception and abort
+  these steps.</p>
+
+  <p>Otherwise, if <var title="">url</var> is not
   "<code><a href=#about:blank>about:blank</a></code>", the user agent must
   <a href=#navigate>navigate</a><!--DONAV window.open()--> the selected
   <a href=#browsing-context>browsing context</a> to the <a href=#absolute-url>absolute URL</a> (or

diff --git a/source b/source
@@ -20881,10 +20881,8 @@ included with Exhibit B.
 
   <ol>
 
-   <li><p>If the <code title="event-click">click</code> event in
-   question is not <span title="concept-events-trusted">trusted</span>
-   (i.e. a <code title="dom-click">click()</code> method call was the
-   reason for the event being dispatched), and either the <code>a</code>
+   <li><p>If the algorithm is not <span>allowed to show a
+   pop-up</span> and either the <code>a</code>
 <!--END w3c-html--><!--DOWNLOAD-->
    element has a <code title="attr-hyperlink-download">download</code> attribute or the
 <!--START w3c-html--><!--DOWNLOAD-->
@@ -61895,6 +61893,8 @@ fur
 
   <h4>Following hyperlinks</h4>
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>When a user <dfn title="following hyperlinks">follows a
   hyperlink</dfn> created by an element, the user agent must <span
   title="resolve a url">resolve</span> the <span>URL</span> given by
@@ -70644,6 +70644,28 @@ END:VCARD</pre>
 
   <div class="impl">
 
+  <hr>
+
+  <p>An algorithm is <dfn>allowed to show a pop-up</dfn> if:
+
+  <ul class="brief">
+
+   <li>it is running in the context of an <span>activation
+   behavior</span> or of the <span
+   title="concept-event-dispatch">dispatching</span> of a <code
+   title="event-click">click</code> event, and</li>
+
+   <li>The <code title="event-click">click</code> event that led to
+   the triggering of the <span>activation behavior</span>, if any, and
+   <code title="event-click">click</code> events of any the <span
+   title="concept-event-dispatch">event dispatching</span> that
+   indirectly led to the algorithm being invoked, if any, are all
+   <span title="concept-events-trusted">trusted</span>.</li>
+
+  </ul>
+
+  <hr>
+
   <p><dfn>The rules for choosing a browsing context given a browsing
   context name</dfn> are as follows. The rules assume that they are
   being applied in the context of a <span>browsing context</span>.</p>
@@ -71071,6 +71093,8 @@ interface <dfn>Window</dfn> : <span>EventTarget</span> {
 
   <div class="impl">
 
+  <!-- This whole section should be rewritten to use algorithmic style -->
+
   <p>The <dfn title="dom-open"><code>open()</code></dfn> method on
   <code>Window</code> objects provides a mechanism for <span
   title="navigate">navigating</span> an existing <span>browsing
@@ -71129,7 +71153,14 @@ interface <dfn>Window</dfn> : <span>EventTarget</span> {
   agent could override the selection of the target browsing context to
   instead target a new tab.</p>
 
-  <p>Then, if <var title="">url</var> is not
+  <p>If the method is not <span>allowed to show a pop-up</span> and
+  applying <span>the rules for choosing a browsing context given a
+  browsing context name</span> using the <var title="">target</var>
+  argument, would result in there not being a chosen browsing context,
+  then throw an <code>InvalidAccessError</code> exception and abort
+  these steps.</p>
+
+  <p>Otherwise, if <var title="">url</var> is not
   "<code>about:blank</code>", the user agent must
   <span>navigate</span><!--DONAV window.open()--> the selected
   <span>browsing context</span> to the <span>absolute URL</span> (or