«

Hi All,

I try to write a script to fix context-menu-hijack.

When the context-menu is hijacked by "oncontextmenu=hijack()", it can be
fixed with "oncontextmenu=null";

But when it is hijacked by "document.attachEvent('oncontextmenu',
hijack)", the previou fixes doesn't work any more.

Is it possible to detach all attached event handler from an event, even
when the name of those event handlers are unknown?


--
___
oo // \\
(_,\/ \_/ \ Xu, Qian
\ \_/_\_/> stanleyxu2005
/_/ \_\

stanleyxu wrote:
> I try to write a script to fix context-menu-hijack.
> [...]
> But when it is hijacked by "document.attachEvent('oncontextmenu',
> hijack)", the previou fixes doesn't work any more.
>
> Is it possible to detach all attached event handler from an event, even
> when the name of those event handlers are unknown?

It is not event handlers that are attached, but event listeners. Event
handlers are intrinsic immutable parts of the DOM that execute attached
event listeners in specified order.

I am afraid it is not possible to detach an event listener from an object if
you don't have a reference to that. Determining a reference at runtime is
generally possible with source code parsing, however the reference can be
obfuscated by the offending script-kiddie just as easily.

Nevertheless, there are a number of other ways to work around context-menu
hijacking, with disabling script support being only one of them.


PointedEars
--
Use any version of Microsoft Frontpage to create your site.
(This won't prevent people from viewing your source, but no one
will want to steal it.)
-- from <http://www.vortex-webdesign.com/help/hidesource.htm>

Thomas 'PointedEars' Lahn wrote:
> stanleyxu wrote:
>> I try to write a script to fix context-menu-hijack.
>> [...]
>> But when it is hijacked by "document.attachEvent('oncontextmenu',
>> hijack)", the previou fixes doesn't work any more.
>>
>> Is it possible to detach all attached event handler from an event, even
>> when the name of those event handlers are unknown?
>
> It is not event handlers that are attached, but event listeners. Event
> handlers are intrinsic immutable parts of the DOM that execute attached
> event listeners in specified order.
>
> I am afraid it is not possible to detach an event listener from an object if
> you don't have a reference to that. Determining a reference at runtime is
> generally possible with source code parsing, however the reference can be
> obfuscated by the offending script-kiddie just as easily.
>
> Nevertheless, there are a number of other ways to work around context-menu
> hijacking, with disabling script support being only one of them.
>
>
> PointedEars

Thanks ^^)

Could you tell me any way to work around context-menu hijacking using
"attachEvent"?


--
___
oo // \\
(_,\/ \_/ \ Xu, Qian
\ \_/_\_/> stanleyxu2005
/_/ \_\

On Jan 13, 7:59 pm, stanleyxu <no_re...@microsoft.com> wrote:

> Could you tell me any way to work around context-menu hijacking using
> "attachEvent"?

There is not any, except disabling script support. attachEvent has the
same privacy protection as setTimeout/setInterval: only one who
attached/set some has right to detach/clear it.

VK wrote:
> On Jan 13, 7:59 pm, stanleyxu <no_re...@microsoft.com> wrote:
>> Could you tell me any way to work around context-menu hijacking using
>> "attachEvent"?
>
> There is not any, except disabling script support. [...]

You are wrong, of course. For example, there are internal and external
extensions that would allow that. I would not have stated that there are
other ways otherwise.


PointedEars
--
realism: HTML 4.01 Strict
evangelism: XHTML 1.0 Strict
madness: XHTML 1.1 as application/xhtml+xml
-- Bjoern Hoehrmann

> > There is not any, except disabling script support. [...]
>
> You are wrong, of course. For example, there are internal and external
> extensions that would allow that. I would not have stated that there are
> other ways otherwise.

Such as?

You know, I'm thinking to introduce a new rule in c.l.j.: "one
possibility to help, that allows one post, that allows one beat down".
So if one can help, he can post the help, and if and only if he can
help, then he can add some comment(s) at the end about the OP's
coding.
IMHO to many people recently decreased their posting content to the
last part only, which is, dare I remind, comes only as a bonus to a
Usenet volunteer and only after the help is provided.

VK wrote:
>>> There is not any, except disabling script support. [...]
>> You are wrong, of course. For example, there are internal and external
>> extensions that would allow that. I would not have stated that there are
>> other ways otherwise.
>
> Such as?

Finding appropriate internal and external browser extensions that work
around the problem is beyond the scope of this newsgroup; suffice it
to say that there are some.

> [rant]

Go away.


PointedEars
--
Use any version of Microsoft Frontpage to create your site.
(This won't prevent people from viewing your source, but no one
will want to steal it.)
-- from <http://www.vortex-webdesign.com/help/hidesource.htm>

On Jan 13, 9:38 pm, Thomas 'PointedEars' Lahn <PointedE...@web.de>
wrote:
> Finding appropriate internal and external browser extensions that work
> around the problem is beyond the scope of this newsgroup; suffice it
> to say that there are some.

If you cannot provide a single sample then "there is some" is a
pointless mumbling and not a statement. It is the same as to say in a
math-related group "your formula is wrong for a number of arguments; I
don't know of any but there are some".

It is the same pointless mumbling as to say "the code you are using is
very bad [end of post]". To make it to be a post again out of useless
mumbling the message has to be "the code you are using is very bad,
look at this instead, it is doing what you want but with a) b) c)
benefits".

This way if you want to prove me wrong, you bring a single sample of
attachEvent for oncontextmenu overridden for IE6/IE7.
Until then I reserve my right to call you a liar.

VK wrote:
> On Jan 13, 9:38 pm, Thomas 'PointedEars' Lahn <PointedE...@web.de>
> wrote:
>> Finding appropriate internal and external browser extensions that work
>> around the problem is beyond the scope of this newsgroup; suffice it
>> to say that there are some.
>
> If you cannot provide a single sample then "there is some" is a
> pointless mumbling and not a statement. [...]

You may believe anything what your delusional mind allows you to. I have
already explained why am am not willing to elaborate on the possibilities
here. If you can't deal with that, so be it.


PointedEars
--
var bugRiddenCrashPronePieceOfJunk = (
navigator.userAgent.indexOf('MSIE 5') != -1
&& navigator.userAgent.indexOf('Mac') != -1
) // Plone, register_function.js:16

Hi You All again,

Theoretically I think it is possible:
If I can take over document.attachEvent() before any hijack-code call
"document.attachEvent('oncontextmenu', hijack)", I can detach any
listeners, cannot I?


--
___
oo // \\
(_,\/ \_/ \ Xu, Qian
\ \_/_\_/> stanleyxu2005
/_/ \_\