[Webkit-unassigned] [Bug 47593] Require a user gesture to open the file dialog

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=47593


Andy Estes <aestes at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |darin at apple.com




--- Comment #12 from Andy Estes <aestes at apple.com>  2011-02-22 15:26:52 PST ---
(In reply to comment #5)
> > > The issue is that the web site can spam the user with file picker dialogs.
> > 
> > Is this different from spamming with alerts, confirms or modal dialogs?
> 
> Requiring a user gesture here matches Firefox as well.  We plan to put in other mitigations at the browser level, but this one seems worth doing at the WebCore level.

Interestingly, this will no longer be true in Firefox 4. They now allow .click() to be called programmatically on input elements (see <https://bugzilla.mozilla.org/show_bug.cgi?id=61098>) without an underlying user gesture. IE also allows this.

I think we should revert this change. It makes us incompatible with other major engines and with at least one major JavaScript framework that I'm aware of (SproutCore), which I think outweighs the benefits of mitigating file chooser spamming.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.