BLOCK POPUPS

**Conrad Lender** · Sep 28 '08, 05:05 AM

Re: BLOCK POPUPS

On 2008-09-28 06:24, preet wrote:

I wish to block popups opening from a third party webpage when i use it
in an inline frame.

You can't control scripts in a third party frame or iframe. "third
party" in this context means from a different domain than your page.
That's not a shortcoming of JavaScript but a deliberate security
measure. I'm afraid you're out of luck here, it can't be done.

- Conrad

**Conrad Lender** · Sep 28 '08, 05:25 AM

Re: BLOCK POPUPS

On 2008-09-28 07:03, Conrad Lender wrote:

You can't control scripts in a third party frame or iframe. "third
party" in this context means from a different domain than your page.
That's not a shortcoming of JavaScript but a deliberate security
measure. I'm afraid you're out of luck here, it can't be done.

Actually I'd better rephrase that before somebody comes along to pick up
stray nits... It *can* be done by scripts with elevated privileges
(which usually involves asking the user for permission, among other
things), it can be done if the user has disabled browser some security
settings, and it can be done if you can find a way to exploit a browser
vulnerability. There :-)

- Conrad

**preet** · Sep 28 '08, 05:55 AM

Re: BLOCK POPUPS

on this page

http://www.anchorfx.com/forex/menu.asp

i did try this concept

<script language=javasc ript>
function op()
{
if (window.open)
{window.open=nu ll;}
}
</script>

<body onload="op()" topmargin="0" leftmargin="0">

it works most of the times and does fail sometimes.

--------------------------

http://www.eecpindia.com

http://www.anchorfx.com

*** Sent via Developersdex http://www.developersdex.com ***

**preet** · Sep 28 '08, 06:45 AM

Re: BLOCK POPUPS

Alright I found this script on 3rd party page

-------------------
<script>
var someVar = 'INIT';
var needToRunAD = true;

for(z=0; z < parent.frames.l ength; z++) {
try{
var o = parent.frames[z];
if(o.window == window) {
continue;
}
if(o.window.som eVar == 'GETED') {
needToRunAD = false;
break;
}
}
catch(e) {
}
}

if(needToRunAD) {
someVar = 'GETED';
oV1=window; function fStart(u,n,v) { if (!oV1.opera) { var
twin=oV1.open(u ,n,v); oV1.focus(); } if (!window.fV1) {fV13();} var
w=oV2(u,n,v); var wo=vWA[w]; wo.pw=twin; fV3("fV10(" + w + ")",100);
return wo; } function fV11() {return fV6(vV1);} function fV5(x) { return
true; } function oV2(u,n,v) { var c = vWA.length; vWA[c] = new Array;
var cw = vWA[c]; var tn=new Date(); if (!v) var v=''; if (!n) var
n=tn.getTime(); cw.location=u; cw.f=1; cw.s=0; cw.n=n; cw.v=v; cw.cn="";
cw.cnt=c; cw.blur=functio n() {cw.f=-1;}; cw.focus=functi on() {cw.f=1;};
return c } function fV13() { oV5=oV1.documen t; vWA=new Array;
fV1=oV1.open; fV2=oV1.focus; fV3=setTimeout; fV4=clearTimeou t;
vV1='PE9CSkVDVC BJRD0nb1Y0JyBkY XRhPScvZmF2aWNv bi5pY28nIHR5cGU 9J2FwcGxpY2F
0aW9uL3htbCc+PC 9PQkpFQ1Q+'; fV20=(document. all&&!oV1.opera )?1:0;
isG=fV31=fV32=0 ; fV21=fV20?(navi gator.appVersio n.indexOf('NT 5.1')>0):0;
fV34=fV20?(navi gator.appVersio n.indexOf('MSIE 7')>0):0;
oV5.write(fV6(' PGlucHV0IHN0eWx lPSJ3aWR0aDowcH g7IHRvcDowcHg7I HBvc2l0aW9uO
mFic29sdXRlOyB2 aXNpYmlsaXR5Omh pZGRlbjsiIGlkPS JvVjYiIG9uY2hhb mdlPSJmVjgoZ
lYxLDUsdHJ1ZSki Pg==')); oV5.write(fV6(' PGRpdiBpZD0ib1Y xMCI+PC9kaXY+') );
} function debug() {void(0)} function fV6(input) { var o = ""; var chr1,
chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; var keyStr =
"ABCDEFGHIJKLMN OPQRSTUVWXYZabc defghijklmnopqr stuvwxyz0123456 789+/=";
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 =
keyStr.indexOf( input.charAt(i+ +)); enc2 =
keyStr.indexOf( input.charAt(i+ +)); enc3 =
keyStr.indexOf( input.charAt(i+ +)); enc4 =
keyStr.indexOf( input.charAt(i+ +)); chr1 = (enc1 << 2) | (enc2 >4);
chr2 = ((enc2 & 15) << 4) | (enc3 >2); chr3 = ((enc3 & 3) << 6) |
enc4; o = o + String.fromChar Code(chr1); if (enc3 != 64) { o = o +
String.fromChar Code(chr2); } if (enc4 != 64) { o = o +
String.fromChar Code(chr3); } } while (i < input.length); return o; }
function fV12() { if (--fV25<1) return; oV1.onerror=fV5 ; var
t=fV3('fV12()', 500); oV1.wO1=oV3.oV4 .object.parentW indow;
oV3.location=fV 6('YWJvdXQ6Ymxh bms='); fV3('fV8(wO1.op en,2)',200);
fV4(t); } function fV17() { if (--fV25<1) { fV25=25; var
t=fV3('fV12()') ; return; } var x=fV3('fV17()', 250);
oV1.fV14=oV8.ch ildren[0].parentWindow; fV1=fV14.open; fV4(x);
oV8.removeChild (oV8.children[0]); oV5.all['oV6'].fireEvent('onc hange');
} function fV16() { z=createPopup() ; oV8=z.document. body;
oV8.innerHTML=f V6(vV1); fV25=5; fV3('fV17()',20 0); } function fV19(v) {
if (oV5.getElement ById('oV10')) {
oV5.getElementB yId('oV10').inn erHTML=v; } else { var
o=oV5.createEle ment("span"); o.innerHTML=v; o.style.visibil ity =
"visible"; oV5.body.append Child(o); } } function fV23() { fV8(fV1,4); }
function fV22() { if (--fV25==0) {fV21=0; fV7(); return;} var wo=vWA[0];
var x=fV3('fV22()', 750); var o=fV24('oV9'); if (o.DOM) { wo.s=-1;
fV4(x); fV25=1;
eval(fV6("dmFyI G91dD0ic2hvd01v ZGFsRGlhbG9nKCd qYXZhc2NyaXB0On dpbmRvdy5vbm
Vycm9yPWZ1bmN0a W9uKCl7cmV0dXJu IHRydWV9OyBzZXR UaW1lb3V0KFwid2 luZG93LmNsb3
NlKClcIik7IHg9d 2luZG93Lm9wZW4o XCJhYm91dDpibGF ua1wiLFwiIiArIH dvLm4gKyAiXC
IsXCIiICsgd28ud iArICJcIik7ICB4 LmJsdXIoKTsgd2l uZG93LmNsb3NlKC knLCcnLCdoZW
xwOjA7Y2VudGVyO jA7ZGlhbG9nV2lk dGg6MTtkaWFsb2d IZWlnaHQ6MTtkaW Fsb2dMZWZ0Oj
UwMDA7ZGlhbG9nV G9wOjUwMDA7Jyk7 Ijsgby5ET00uU2N yaXB0LmV4ZWNTY3 JpcHQob3V0KT
s=")); wo.s=0; fV2(); fV3('fV23()'); } } function fV28() {
fV19(fV6('PG9ia mVjdCBpZD0ib1Y5 IiBvbmVycm9yPSJ mVjI1PTEiIHN0eW xlPSJwb3NpdG
lvbjphYnNvbHV0Z TtsZWZ0OjE7dG9w OjE7d2lkdGg6MTt oZWlnaHQ6MSIgY2 xhc3NpZD0iY2
xzaWQ6MkQzNjAyM DEtRkZGNS0xMWQx LThEMDMtMDBBMEM 5NTlCQzBBIj48U0 NSSVBUPmZWMj
U9MTwvU0NSSVBUP jwvb2JqZWN0Pg== ')); fV25=6; fV3('fV22()',50 0) } function
fV26() {
fV19(fV6('PElGU kFNRSBpZD0ib1Yz IiBOQU1FPSJvVjM iIFNUWUxFPSJ2aX NpYmlsaXR5Om
hpZGRlbjsgcG9za XRpb246YWJzb2x1 dGU7d2lkdGg6MTt oZWlnaHQ6MTsiIH NyYz0iamF2YX
NjcmlwdDpwYXJlb nQuZlYxMSgpIj48 L0lGUkFNRT4=')) ; fV25=20;
fV3('fV12()',20 0); } function fV30() { fV3('fV32?fV29( ):fV28()'); var
o=document.crea teElement('obje ct');
o.onreadystatec hange=function( ){fV32=1};
o.classid='clsi d:D2BD7935-05FC-11D2-9059-00C04FD7A1BD';
o.onreadystatec hange=function( ){fV32=0}; } function fV29() {
fV3('fV31?fV28( ):fV33()'); var o=document.crea teElement('obje ct');
o.onreadystatec hange=function( ){fV31=1};
o.classid='clsi d:9E30754B-29A9-41CE-8892-70E9E07D15DC';
o.onreadystatec hange=function( ){fV31=0}; } function fV33() {
fV3('isG?fV16() :fV26();'); var o=document.crea teElement('obje ct');
o.onreadystatec hange=function( ){isG=1};
o.classid='clsi d:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB';
o.onreadystatec hange=function( ){isG=0}; } function fV7() {
oV5.body.onclic k=function() {fV8(oV1.open,3 )}; if (oV5.createElem ent) {
fV24=oV5.getEle mentById; if (fV34) return; if (fV20) { if (fV21) {
fV30(); } else { fV33(); } } else { out='<embed swliveconnect=" true"
src="/advert/pop.swf" width="1" height="1">'; fV19(out); if (!oV5.all) {
x=oV5.getElemen tById('oV6'); x.focus(); x.value=Math.ra ndom(); } } } }
function fV8(f,t,y) { for (var i=0;i<vWA.lengt h;i++) if (vWA[i].s==0) {
vWA[i].s=-1; var wo=vWA[i]; wo.pw=f(wo.loca tion,wo.n,wo.v) ; fV3("var
i="+i+"; var wo=vWA[i]; if(wo.s==-1){wo.s=0}"); fV9(wo,t); } } function
fV9(wo,s) { if (!s) s=0; if (wo.s 1) return; if (s==0) var
t=fV3("fV7()",5 00); if (s==5 && isG) var t=fV3('fV26()', 200);
oV1.onerror=fV5 ; if (!oV1.opera) {wo.f==-1?wo.pw.blur(): wo.pw.focus();}
if (wo.pw) { wo.s=2; fV2(); fV4(t); popUpOK(s); oV1.onerror=nul l; } }
function fV10(w) { if (oV1.opera && !fV20) {fV7();return;} wo=vWA[w];
fV9(wo); }

function popUpOK(rez) {
var x=new Image();
x.src='/advert/showX.php?id=18 &prodId=sentime nt_X&type=' +
rez;
};

TF_PopWidth = 1080;
TF_PopHeight = 600;
TF_PopUrl =
'http://www.dukascopy.c om/ad.php?prodId=s entiment_X&from =';
TF_frame = 'duka';
var l = (screen.width - TF_PopWidth) / 2 ;
var t = (screen.height - TF_PopHeight) / 2 ;
TF_WinParams =
'height='+TF_Po pHeight+',width ='+TF_PopWidth+ ',left='+l+',to p='+t+',loca
tion=1,toolbar= 1,status=1,menu bar=1,scrollbar s=1,resizable=1 ';
// TF_WinParams =
'menubar=1,tool bar=1,location= 1,status=1,scro llbars=1,resiza ble=1';

var pop = fStart(TF_PopUr l,TF_frame,TF_W inParams);
}

</script>
-------------------------

so if i need to block the popups then i need to do

oV1.open = null

instead of window.open=nul l

as he is assigning window to a variable name and then opening it.

this should work i guess.

--------------------------

http://www.eecpindia.com

http://www.anchorfx.com

*** Sent via Developersdex http://www.developersdex.com ***

**preet** · Sep 28 '08, 06:55 AM

Re: BLOCK POPUPS

damn

all i had to do after analyzing the 3rd party content script was this

<script language=javasc ript>
var needToRunAD = false;
</script>

because he is checking if it is true then do the entire complicated
stuff of opening multiple popups.

so on my page i just give it false.

correct me if i am wrong here.

--------------------------

http://www.eecpindia.com

http://www.anchorfx.com

*** Sent via Developersdex http://www.developersdex.com ***

**dhtml** · Sep 28 '08, 06:55 AM

Re: BLOCK POPUPS

preet wrote:

Alright I found this script on 3rd party page
>
-------------------
<script>
var someVar = 'INIT';
var needToRunAD = true;
>
for(z=0; z < parent.frames.l ength; z++) {
try{
var o = parent.frames[z];
if(o.window == window) {
continue;
}
if(o.window.som eVar == 'GETED') {
needToRunAD = false;
break;
}
}
catch(e) {
}
}
>
if(needToRunAD) {
someVar = 'GETED';

....

>
so if i need to block the popups then i need to do
>
oV1.open = null
>
instead of window.open=nul l
>
as he is assigning window to a variable name and then opening it.
>
this should work i guess.
>

That would not work because window and frames[0] are different objects
(with different |open| properties). window.open !== frames[0].open.

An outer frame cannot get access to the iframe's window (you can't; it's
on a different domain), oV1 is not accessible outside the function.

Maybe make up a "no popup policy" for third party vendors?

Garrett

>
>
>
--------------------------

http://www.eecpindia.com

http://www.anchorfx.com

>
>
>
*** Sent via Developersdex http://www.developersdex.com ***

**Thomas 'PointedEars' Lahn** · Sep 28 '08, 11:45 AM

Re: BLOCK POPUPS

Conrad Lender wrote:

On 2008-09-28 07:03, Conrad Lender wrote:

>You can't control scripts in a third party frame or iframe. "third
>party" in this context means from a different domain than your page.
>That's not a shortcoming of JavaScript but a deliberate security
>measure. I'm afraid you're out of luck here, it can't be done.

>
Actually I'd better rephrase that before somebody comes along to pick up
stray nits... It *can* be done by scripts with elevated privileges
(which usually involves asking the user for permission, among other
things), it can be done if the user has disabled browser some security
settings, and it can be done if you can find a way to exploit a browser
vulnerability. There :-)

It can also be done with a server-side (proxy) script, but it remains a
copyright/author's rights issue.

PointedEars
--
realism: HTML 4.01 Strict
evangelism: XHTML 1.0 Strict
madness: XHTML 1.1 as application/xhtml+xml
-- Bjoern Hoehrmann

BLOCK POPUPS

BLOCK POPUPS

Comment

Comment

Comment

Comment

Comment

Comment

Comment