8

So, I am using Orion a lot, might be using Safari only for some pages my userscripts don't run. Anyway I am having this strange issue, I've talked about this before. But today I found a hidden feature!

When you have a popup window, it only have a title bar and no address bar or button, though there's a menu on right click which enables "focus mode"? and when you untick it, this happens!

  • Vlad replied to this.

    piratx OK, so what would you imagine popup window to be/look like? Popup windows in Safari also do not have address bar right?

      Okay here is Safari on the same thing. Popups can be either pages which came from links with target=_blank or those annoying ad popups (most of times).
      But here we talk about the one from _blank links, the opposite of some click on a help/support button that will open a chat (popup window) for us, like Google Workspace, Microsoft support, Apple Support etc. Those support pages in Safari are having a window without address bar but in all the other cases the window have an address bar.

      • Vlad replied to this.

        piratx Can you give steps to reproduce : what URL, that did you click and how?

          Not sure of an easy website to point you to for this, but I can reproduce this via a couple of local HTML files. The technique works fine on the web though.

          Just pop both index.html and target-popup.html in the same folder, then open index.html in Orion.

          Firefox blocks this popup by default:

          Likewise, Safari blocks this too. I think this might be due to the way they are triggering the popup, so there might be 2 bugs here - one being that Orion doesn't match how Safari handles/rejects pop-ups, and the other being that there's no way to see what page a (legitimately triggered) pop-up is on - most browsers have a non-editable URL bar that lets you see the site you're on.

          That's what Firefox does - you can't edit this URL bar, but you can at least see the full URL you're at.

          • Vlad replied to this.

            gp Hmm.. I am a bit confused now, as the issue you mention maybe a different to what the OP is suggesting (appearance of the window itself).

            • gp replied to this.

              Vlad Aha oops, I think there's 3 issues here then!

              You can reproduce them all from the HTML demo I gave above.

              1. (From the OP) - after toggling focus mode on and off, it makes the UI different to normal - more like "Safari" with a large text title on the upper left of the window. I think this is because on disabling Focus mode, the window chrome is restored to default, without checking if the current window is meant to be a "no URL bar and toolbar" window.

              2. Security issue - you shouldn't allow a popup window with no URL bar visible, as this is a phisher's paradise for popping up fake MS 365 login prompts and asking for credential re-entry (!)

              3. Semi security issue - Orion seems to be more permissive of pop-ups than Safari or Firefox. Likely should be blocked by default via this method.

              a year later

              Im i wrong if i remember safari or other browsers use to have a small butoon in the right corner to expand tool bar to show adress bar on pop ups?

              • Vlad replied to this.

                made a mockup of how i remember it:


                if i remember correctly the button would only be there when collapsed, and then dissapear after expanding

                  Vlad it doesnt seem to be present anymore. i tried googling it seeing if there was any screenshots of older versions with it, but couldnt find any

                    Vlad now that i think about it, i think it was a general Mac OS thing. also for finder windows. found this:

                    I think its a good solution

                      Yeah after googling it a bit. it was a general Mac Os thing to colapse tool bar into a narow bar

                      pretty sure Safari had it aswell when adress bar was hidden in pop ups

                        Impossible to find earlier Safari versions, so i tried earlier browser and found both Shiira and Camino with it.
                        cant find them colapsed tho

                          A website should not be able top dictate which browser UI elements are available for me to use. It should not be able to hide my bookmarks / extensions / anything. I configured my browser to have the features I want to use - those features should be there no matter what page I am on.

                          Steps to reproduce:

                          1. Navigate to: https://boards.greenhouse.io/clearcover/jobs/6358520002?t=0eadce002us#app
                          2. Click "Apply with LinkedIn button"
                          3. Be unable to use my password manager to login because my installed extensions are not available in the popup window

                          Expected behavior:
                          I expect the popup window to contain all the UI/Chrome elements that I have configured to be present in my browser window.

                          • Address bar
                          • Extensions
                          • Bookmarks
                          • Sidebar
                          • ...

                          Actual behavior:

                          • No address bar
                          • No Bookmarks
                          • No extensions
                          • Unable to open sidebar

                          Orion, OS version; hardware type:
                          Version 0.99.120.1-beta (WebKit 614.1.20)
                          MacBook Pro (macOS Monterey 12.6 build 21G115)

                          Image/Video:

                            This behavior exists in just about every browser out there, is there one you're aware of where this isn't the case?

                            What password manager extension do you use? I use Bitwarden, and if you right-click in one of the fields on the login form, you can access the Bitwarden menu and use auto-fill.

                              I realize this is common in most browsers. I think it is a bug. A website should have no say in anything outside the content window. This is a security / privacy issue - I cannot see the URL to verify I am submitting information to the site I am expecting. This is an accessibility issue - I have bookmarklets and extensions that I use to modify styles to make sites more readable to me. This is a common sense issue - it is my browser and a website shouldn't be able to dictate what I can and cannot do.
                              At the very least, I should have an option to allow / disallow this behavior.
                              One browser I used to use (way back in the day) was K-Meleon which allowed the user to configure this behavior. Firefox used to allow the user to configure this behavior. IE & Chrome used to always display at least a read-only address bar as phishing protection.

                              I use Bitwarden as well - thank you for the reminder about the context menu feature.

                                This is simply what a "popup" window always behaves like, across major browsers. I believe you are asking for the ability to prevent popup windows from not having certain UI features.