control popup

[KryptoS]

Why can't I control the popup anymore when I link to another site?

eg:

var url = '

http://www.hotmail.com';

var win = window.open(url,'','width=250,height=250,scrollbars=no,toolbar=no,location=no,status=no,menubar=no,directories=no,resizable=no,scrollbars=no');
win.moveTo(20,20);


when I use a link to my own site eg. test.php then all works. But not when I link to another domain?

The One And Only KryptoS

 

[NateBro]

it should not matter what domain the link is, is there a security problem?

 

[KryptoS]

I can not access the properties of the new secondary window. I always get an error in the javascript console saying "Error: uncaught exception: Permission denied to get property <property_name or method_name>. Why is that?
It is because of the cross-domain script security restriction (also referred as the "Same Origin Policy"). A script loaded in a window (or frame) from a distinct origin (domain name) cannot get nor set properties of another window (or frame) or the properties of any of its HTML objects coming from another distinct origin (domain name). Therefore, before executing a script targeting a secondary window, the browser in the main window will verify that the secondary window has the same domain name.
More reading on the cross-domain script security restriction:

http://www.mozilla.org/projects/security/components/same-origin.html

Aaaaaaaaaaaah f*ck!!!

The One And Only KryptoS