Has this been reported in bugzilla? I can't find it anywhere.... Cheers, Clint > -----Original Message----- > From: Tobias Boonstoppel [mailto:boonstoppel@xxxxxxxxx] > Sent: Tuesday, August 23, 2005 7:10 AM > To: bugtraq@xxxxxxxxxxxxxxxxx > Subject: unload event in ie/mozilla/opera > > > in nearly all browsers* you can overwrite the window location in the > "onunload" event. > > that means you can "keep" the user on a site. when you type a new url > in the address-bar, javascript overwrites it. thats a paradies for > fishers, porn-site-hoster etc...... > > here the html/javascript code: > > <html> > <head> > <script> > window.unlock = false; > window.onunload=function() > { > if(!window.unlock) > window.location.href='unload.html'; > } > document.onmousedown=function() > { > window.unlock = true; > } > </script> > </head> > <body> > <a href="?link=1">Link 1</a><br> > <a href="?link=2">Link 2</a><br> > <a href="?link=3">Link 3</a><br> > <a href="?link=4">Link 4</a><br> > </body> > </html> > > > cheers > Tobias Boonstoppel > > > ps: * i testet it on firefox (linux / window) opera (linux) and > internet explorer. >
