Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I agree that there is potential here for phishing. This was reported as a <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=229050" rel="nofollow">bug in FireFox</a> quite a long time ago, but the problem is this:</p> <pre><code>&lt;body onmousedown="document.getElementById('changeMe').href='www.somewhereelse.com'"&gt; &lt;a id="changeMe" href="www.google.com"&gt;google&lt;/a&gt; &lt;/body&gt; </code></pre> <p>Events bubble up to their parent, you would need to detect if an onmousedown event was going to change the href of a child element. Sounds reasonable? Okay, how about this:</p> <pre><code>&lt;script&gt; function switcher() { window.location = "www.somewhereelse.com"; return false; } &lt;/script&gt; &lt;body onmousedown="switcher()"&gt; &lt;a href="www.google.com"&gt;google&lt;/a&gt; &lt;/body&gt; </code></pre> <p>So we need to look out for <code>window.location</code> in functions triggered by onmousedown events as well. Still sound reasonable? How about if I have the onmousedown event remove the link altogether, replace it with a new element and then trigger the click on that. I can keep coming up with examples.</p> <p>The point is, Javascript can be used to misdirect people using the status bar - you shouldn't trust it, you can only trust the URL.</p> <p>To change this browsers would need to give the set href value on a link at the time of the click presidency over any other events that might happen, basically disable mouse events on anchor tags. I would venture to guess they probably won't do this, it would break too many applications that already exist.</p> <p><strong>Edit:</strong> Alternatively, I've seen people propose different methods of detecting and warning the user about possible link hijacking, but I've not seen any implemented yet.</p>
    singulars
    1. This table or related slice is empty.
    1. POWhy do browsers allow onmousedown JS to change href?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USnwellcome
    1. USnwellcome
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POWhy do browsers allow onmousedown JS to change href?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COJust to understand this a little better and to get your view on this: Is it possible, then, for a browser to delay mouse actions, until after the navigation has happened? That will mean that if the link is within the page (e.g. `href="#foo"`) the JS will still work (browsers could indicate this in the url preview), but if the link actually points to a different page, you are sent to the page that you actually think you are going to. If, as Tgr suggested, browsers transparently told the website where you are going, browsers could let you know that the site is being told using a small icon.
      singulars
      1. PO
      1. USUmang
    2. COTo rephrase your approach: First let the navigation happen based on the href value of the link when you clicked it, then execute Javascript event and let the user know with an icon that a Javascript event is going to be delayed by the navigation. The problem I see is: what if the event was meant to stop the navigation?
      singulars
      1. PO
      1. USnwellcome
    3. COI have more thoughts I can't fit in the comments, should we move to a chat?
      singulars
      1. PO
      1. USnwellcome
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload