如何断开来自opener的JavaScript弹出窗口 [英] How to disconnect JavaScript popup from opener

问题描述

 < a href =http： //external.domain.tld/
 onclick =window.open（this.href，'_blank'，
'width = 512，height = 512，left = 200，top = 100'） ; return false> 
打开弹出窗口
< / a> 
  

这工作正常，但我的问题是在弹出窗口中加载的文档具有权限改变开启器窗口的位置。当弹出窗口中的文档来自不同的域时，这甚至可以工作。它没有读取位置的权限，但可以更改位置。我不想那样。我希望弹出窗口与我的主页面完全断开。

即使没有JavaScript，它也不起作用。当我通过使用 target =_ blank属性在新选项卡中打开其他页面时，该选项卡仍然被允许导航到 opener 窗口并更改其位置：

 < a href =http：//external.domain。 tld /target =_ blank> 
在新标签中打开
< / a> 
  

这是不应该被允许的打开文档中的代码：

 < script> 
 opener.location.href =http：//badsite.tld/; 
< / script> 
  

您可以看到现场演示此处。点击两个链接中的一个，在弹出窗口或新标签中打开另一个页面，然后在开启器窗口中加载第三个页面。这就是我想要阻止的。

是否有一些技巧可以用来打开开启器窗口和打开的窗口之间的连接？理想情况下，打开的窗口不应该知道它是由任何其他窗口打开的。

解决方案

如果子窗口中的页面在你的控制之下，你可以为子页面中的开启者指定null：

  window.opener = null; 
  

通过将它作为JavaScript中的第一条语句。

如果该页面不在您的控制范围内或位于其他域中，请在打开时执行此操作：

  popup = window.open（this.href，'_blank'，'width = 512，height = 512，left = 200，top = 100'）; 
 popup.opener = null; 
  

I'm opening a popup from my main page with code like this:

<a href="http://external.domain.tld/"
   onclick="window.open(this.href, '_blank', 
       'width=512,height=512,left=200,top=100');return false">
 Open popup
</a>

This works fine, but my problem is that the document which is loaded in the popup window has the permission to change the location of the opener window. This even works when the document in the popup is from a different domain. It has no permission to read the location but it is allowed to change the location. I don't want that. I want the popup to be completely disconnected from my main page.

Even without JavaScript it doesn't work. When I open the other page in a new tab by using the target="_blank" attribute then this tab is still allowed to navigate to the opener window and change its location:

<a href="http://external.domain.tld/" target="_blank">
  Open in new tab
</a>

This is the code in the opened document which should not be allowed:

<script>
  opener.location.href = "http://badsite.tld/";
</script>

You can see a live demo here. Click one of the two links to open an other page in a popup or a new tab which then loads a third page in the opener window. That's what I'm trying to prevent.

Is there some trick I can use to break the connection between the opener window and the opened window? Ideally the opened window should not know that it was opened by any other window at all.

解决方案

If the page in the child window is in your control, you can assign null to the opener in the child page:

window.opener = null;

By making this as the first statement in your javascript.

If the page is not in your control or is in a different domain, then do it while opening:

popup = window.open(this.href, '_blank', 'width=512,height=512,left=200,top=100');
popup.opener = null;

这篇关于如何断开来自opener的JavaScript弹出窗口的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！