Question

I’m opening a popup window via javascript. I’m trying to set some of the display parameters – specifically we want to hide the location and statusbar, but every browser I’ve tested this in, the location and status bars still display.

My code looks like this:

newwindow=window.open(url,'name','height=250,width=290,left=200,top=200,location=no,resizable=yes,scrollbars=yes,toolbar=no,status=no');

Any ideas? The client is insisting on a popup window, rather than a hover tooltip.

Answer 1

Yes, some parameters are disabled. The reason is that it should not be possible to open a window that pretends to be something else.

The exact rules depends on the browser, the scope of the page (intranet/public), and the user settings. Most browsers won’t remove the address bar, so that you can always see where the page is coming from.

You can for example read here about the restrictions in Internet Explorer.

Some quotes:

“Internet Explorer 6 for Windows XP
SP2 requires that the window title
bar and status bar are always in the
visible area of the display; if the
address bar is displayed, it must also
remain visible. By placing these
restrictions on script-opened windows,
the Window Restrictions security
feature prevents malicious code from
hiding information and from spoofing
user interfaces. The Window
restrictions feature is on by default
for the Internet zone, and the feature
is off by default for the Local
Intranet and Trusted Sites zones.”

and:

“The status bar is an Internet
Explorer security feature that
provides the user with Internet
Explorer security zone information.
Prior to Internet Explorer 6 for
Windows XP SP2, the status bar could
be hidden from the user by scripts
that call the window.open method. With
the status bar hidden from view, users
could be deceived into thinking that
they were on a trusted site when they
were actually interacting with a
malicious host.

With window restrictions in place, the
status bar cannot be turned off for
any window created by the window.open
method; it is always visible for all
Internet Explorer windows. The zone
information that the status bar
contains cannot be spoofed or hidden
from view, so that the user always
knows in what security zone the
content is being displayed.”

This is about IE 6, as that’s when this was introduced. There were some furhter changes in IE 7, but that mostly has to do with how the navigation changed, making some parameters of the open command work differently or being obsolete.