Thank you for your reply but why do you say "Oh dear"? Is that a bad
idea to do stuff like that? This pop-up is for web based application,
it's not an advertisement or anything like that.
Unfortunately, the nature of the web is that your content is being
hosted in a general application that may be simultaneously hosting
content from lots of sites.
As a result, it is becoming increasingly common for *some* programmers
to exploit this feature to their advantage. The latest phishing attack
uses the ability of a parent window to control the content of a child
window with potentially devastating effects. To see it in action,
visit:
<URL:
http://secunia.com/>
and click on the "Window Injection Vulnerability" link.
Basically, if you click on a link on my site that opens a child window,
I can control the content of the child even if the URL is to some other
site. I can then replace links in the child (say the 'logon' link)
with my own that goes to a lookalike page that just collects your id &
password.
This type of cross-scripting has been stopped at the server
level, but not the client. Whilst there are robust solutions that
maintain the ability of a window to open children, I dare say the
immediate response will be to disallow any communication between opener
and child (note that Microsoft's initial response to macro viruses in
Word was to turn off all macros - other browser vendors may do it a
little smarter, but it will take some time for a consistent approach to
be adopted).
So any application that is written now that depends on opener/child
communication is likely to fall apart in the near future.
