Onderwerp: unload event in ie/mozilla/opera

in nearly all browsers* you can overwrite the window location in the
"onunload" event.

that means you can "keep" the user on a site. when you type a new url
in the address-bar, javascript overwrites it. thats a paradies for
fishers, porn-site-hoster etc......

here the html/javascript code:

<html>
<head>
<script>
window.unlock =3D false;
window.onunload=3Dfunction()
{
if(!window.unlock)
window.location.href=3D'unload.html';
}
document.onmousedown=3Dfunction()
{
window.unlock =3D true;
}
</script>
</head>
<body>
<a href=3D"?link=3D1">Link 1</a><br>
<a href=3D"?link=3D2">Link 2</a><br>
<a href=3D"?link=3D3">Link 3</a><br>
<a href=3D"?link=3D4">Link 4</a><br>
</body>
</html>


cheers
Tobias Boonstoppel


ps: * i testet it on firefox (linux / window) opera (linux) and
internet explorer.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 25 Aug 2005 00:31:28 +0200, Niels Bakker <niels-bugtraq@bakker.net>
wrote:

> * gillettdavid@fhda.edu (David Gillett) [Thu 25 Aug 2005, 00:02 CEST]:
> > What's worse, some browsers interpret "close the browser" to trigger
> >the onunload() method, and that's just wrooong.
>
> Not that wrong, the website author could want to clear a session cookie
> or similar.

If it's a session cookie then it'll die automatically when the browser
closes down. No need to clear it.

There are many useful features of browsers (and other software - remember
when it used to be a kindness to leave an MTA as an open relay and
considered rude not to?) that have had to be deactivated because of abuse by
scum such as spammers. Firing up the onUnload event on window/browser
shutdown is one that should be added to that list IMO.

- --
G. Stewart - gstewart@spamcop.net

Maintainer's Motto:
If we can't fix it, it ain't broke.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDDsdQK5oiGLo9AcYRAvQxAJ9YKaw2iCsoBrKtWbS5Cb Ug5k8yaACgkplF
Sexe+P8SsRj1qiNhDIdYll8=
=4lWX
-----END PGP SIGNATURE-----

--4wkndigzIeYF6Hbg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Aug 25, 2005 at 12:31:28AM +0200, Niels Bakker wrote:
> > What's worse, some browsers interpret "close the browser" to
> > trigger the onunload() method, and that's just wrooong.
> Not that wrong, the website author could want to clear a
> session cookie or similar.

Cookies expire at the end of session by themselves unless the
website (or CMS, for that matter) author cared to set the
expiration explicitly.

http://www.cookiecentral.com/faq/#3.3

--=20
---- WBR, Michael Shigorin <mike@altlinux.ru>
------ Linux.Kiev http://www.linux.kiev.ua/

--4wkndigzIeYF6Hbg
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFDDtS1bsPDprYMm3IRAnVPAKCfLmkihSD0zzrsVU9WEk +sjBA/5QCg3HU6
AKnJ/uty9e3oxAgbyE3MuR0=
=IAS3
-----END PGP SIGNATURE-----

--4wkndigzIeYF6Hbg--

"that means you can "keep" the user on a site. when you type a new url
in the address-bar, javascript overwrites it."
Annoying, but not very dangerous.
When I type a new url, I get brought to a "file://localhost/[...]/unload.html". Then I type a new url, and that's ok.
I wouldn't disable javascript for that.