views:

145

answers:

2

I am building an application which has requirements stating that all browser features must be disabled. (It's a test taking application and they are worried about security/cheating.)

I popup a new window so that I can make it fullscreen, disable the menu bar, tool bar etc. However Firefox still has two icons remaining that I can't figure out how to disable. The 'Page' icon and the 'Bookmark' star icon are still on even when I call window.open with location=no. Here is the window.open command:

window.open("filename", "test", "fullscreen=yes,status=no,toolbar=no,location=no,menu=no,directories=no,scrollbars=yes");

Is there anything I can do about this?

+1  A: 

If you don't have control of the computer the user is taking the test on, there's nothing you can do (and opening a full screen window won't prevent cheating for savvy users, either).

If you do have control over the computer or can instruct the user to install an application, you'd be best suited by building an actual application with embedded WebKit or Gecko.

ceejayoz
+4  A: 

From the MDC documentation for window.open():

Mozilla and Firefox users can force new windows to always render the location bar by setting dom.disable_window_open_feature.location to true in about:config or in their user.js file

In Firefox 3, dom.disable_window_open_feature.location now defaults to true, forcing the presence of the Location Bar much like in IE7.

This was done to help thwart phishing exploits. You're better off (your users are better off) leaving it enabled, even if you have control over the machines on which the browser is running.

You should really be designing your application such that knowing or bookmarking the URL won't help would-be cheaters. For instance: don't accept an answer to a question when an answer has been previously submitted.

Shog9
agreed with designing the application correctly so that the url doesn't reveal any secrets, or the html source code either. And navigating back shouldn't allow you to change the answer (you can't really block the back/forward buttons either. You can right-click->back, as well as use the back button on mice).
FryGuy
You don't need to block anything, just keep track of which answers have already been submitted and ignore them if submitted again. Unless you didn't want users to even *see* previous questions, in which case there's something suspicious about the test itself...
Shog9
I think the concern with cheating was more along the lines of opening Google in another tab or something.
ceejayoz
Heh... If that's true, then either disabling Internet access, or disabling all browsers are the only real options.
Shog9
I know that none of these things will prevent someone from simply opening a new web browser - but the idea is at least to discourage users from actions that are undesirable.
Kyle Boon