Review Request: Prevent Konqueror's address bar from being hidden by default

[David Faure]

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
http://git.reviewboard.kde.org/r/105749/
-----------------------------------------------------------

(Updated July 27, 2012, 8:52 a.m.)


Review request for Dolphin, KDE Base Apps and David Faure.


Changes
-------

(adding kfm-devel as CC)


Description
-------

The attached patch attempts to resolve a security concern in Konqueror when browsing the web. The concern results from a website, through the use of the javascript window.open API, requests the creation of a new window (pop up window) with all its toolbars disabled. When Konqueror gets such requests it simply disables all toolbars in the main window including the one that contains the address line edit widget. This is a problem because it makes it possible for sites to spoof the user into providing personal information by mimicking native input dialog such as the password dialog.

As such this patch attempts to solve the problem in the same manner it seems to be addressed in other major browsers such as Firefox and Chromium. Namely, Konqueror will no longer hide the toolbar containing the address line edit widget by default. The user must explicitly override the default settings by adding the following configuration option to konquerorrc:

[DisableWindowOpenFeatures]
LocationBar=false
    


Diffs
-----

  konqueror/src/konqcombo.cpp cdf840a 
  konqueror/src/konqmainwindow.cpp 081509e 

Diff: http://git.reviewboard.kde.org/r/105749/diff/


Testing
-------


Screenshots
-----------

before the change
  http://git.reviewboard.kde.org/r/105749/s/645/
after the change
  http://git.reviewboard.kde.org/r/105749/s/646/


Thanks,

Dawit Alemayehu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20120727/449afae1/attachment.htm>