Re: [whatwg] api for fullscreen() - security issues

2010-02-01 Thread Robert O'Callahan
On Tue, Feb 2, 2010 at 5:00 AM, Simon Fraser wrote: > On Feb 1, 2010, at 1:14 AM, Henri Sivonen wrote: > > > On Jan 31, 2010, at 05:08, Simon Fraser wrote: > > > >> * disallow enterFullscreen() from a frame or iframe > > > > This might be a problem if video sites transition their embedding > boil

Re: [whatwg] api for fullscreen() - security issues

2010-02-01 Thread Simon Fraser
On Feb 1, 2010, at 1:14 AM, Henri Sivonen wrote: > On Jan 31, 2010, at 05:08, Simon Fraser wrote: > >> * disallow enterFullscreen() from a frame or iframe > > This might be a problem if video sites transition their embedding boilerplate > to an iframe in order to be able to be able to serve HTM

Re: [whatwg] api for fullscreen() - security issues

2010-02-01 Thread Henri Sivonen
On Jan 31, 2010, at 05:08, Simon Fraser wrote: > * disallow enterFullscreen() from a frame or iframe This might be a problem if video sites transition their embedding boilerplate to an iframe in order to be able to be able to serve HTML5, Flash, ActiveX, etc. depending on UA without requiring t

Re: [whatwg] api for fullscreen() - security issues

2010-01-31 Thread Olli Pettay
On 1/31/10 6:38 AM, Tab Atkins Jr. wrote: This one seems kind of weird. Does the spec currently distinguish significantly between a user-initiated click and a script-initiated one? DOM 3 Events draft does have the concept of trusted events; UA/user generated events are trusted, script generat

Re: [whatwg] api for fullscreen() - security issues

2010-01-30 Thread Boris Zbarsky
On 1/30/10 11:38 PM, Tab Atkins Jr. wrote: On Sat, Jan 30, 2010 at 9:08 PM, Simon Fraser wrote: * require that enterFullscreen() is being called inside a user-event handler (e.g. click or keypress) to avoid drive-by fullscreen annoyances. This one seems kind of weird. Does the spec currently

Re: [whatwg] api for fullscreen() - security issues

2010-01-30 Thread Tab Atkins Jr.
On Sat, Jan 30, 2010 at 9:08 PM, Simon Fraser wrote: > * require that enterFullscreen() is being called inside a user-event handler > (e.g. click or keypress) to avoid drive-by fullscreen annoyances. This one seems kind of weird. Does the spec currently distinguish significantly between a user-i

Re: [whatwg] api for fullscreen() - security issues

2010-01-30 Thread Simon Fraser
On Jan 28, 2010, at 6:42 pm, Robert O'Callahan wrote: > On Fri, Jan 29, 2010 at 12:51 PM, Simon Fraser wrote: > We have been discussing a more general fullscreen API that lets you take the > page fullscreen (perhaps with the ability to focus on a single element), as > Maciej mentions. We have n