Chromeless Windows on IE

[rhowes]

Hi All

This is a warning to anyone using the chromeless windows trick on IE (resizing a fullscreen windows to create a popup with no chrome). This feature will not work in XP with Service Pack 1.

Since this has been done my Micro$oft on purpose, to close what they see as a bug and security hole, expect this to be the way of the future.

We have had to redesign our web-based app because of this and the effort is not trivial.

Regards
Richard

 

[ZekeO238]

Even if you resize the fullscreen window?

 

[rhowes]

Yip. That's the point, you can no longer resize a fullscreen window, it simply ignores the window.resizeTo(x,y) instruction and remains full screen.

I tested it with our application, and on searching Google I found a statement my an M$ techie that confirms they see this as a bug and security concern and have patched IE to prevent resizing full screen windows.

Cheers
Richard

 

[ZekeO238]

Does it say exactly how resizing fullscreen windows is a bug? If anything its better than having a fullscreen window in my opinion. At least you can go to the task bar and close a fullscreen window rather than Alt+F4'ing whihc Im less used to.

 

[Cadwalader]

It's amazing that M$ would do that, yet leave IIS WIDE open for attack--with hardly an effective effort to correct it!


Sorry, just ranting... Hope I was of some help...
--OR--
Thanks for the help...
--Rich

 

[rhowes]

M$ did say why it was a security risk and bug.

The security part is because they say you can open a resized full-screen window over the message that asks if you want to accept an ActiveX control, thereby hiding it from the user. How this is a security hole I fail to see as the user still has to accept the control for it to be installed???

As for the bug, they say it's a bug because a full-screen window, by definition, should be full screen and not resizable to fill only part of your screen (no longer making it full-screen

Cheers
Richard