Issue with Protected Mode in IE8 and Win7

Question

Hello,

 I have faced with very strange issue in IE 8 and Win7.

 Description (example):

1. There is page where is button "Change Mood", which opens dialog window where are two buttons: "Make me Sad" and "Make me Happy". When press on these button Confirmation window displays.
2. Press OK button on confirmation window closes Confirmation and Modal window and redirects user to another page.
3. Wokrflow: Change Mood-Make me Happy --> Change Mood-Make me Sad --> Change Mood-Make me Happy --> Change Mood-Make me Sad --> Change Mood-Make me Happy --> Confirmation window IS NOT displayed and user IS NOT redirected to another page.

 Technologies: JavaScript (a lot of JavaScript), JSP, Servlets.

 Reproduction:

Scenario 1. UAC enabled (default level) | Protected Mode: off  - Issue appear

Scenario 2. UAC enabled (default level) | Protected Mode: on  - Issue does not appear (I can repeat this steps for ages)

Scenario 3. UAC enabled (lower level then default) | Protected Mode: off - Issue appear

Scenario 4. UAC enabled (lower level then default) | Protected Mode: on  - Issue does not appear (I can repeat this steps for ages)

Scenario 5. UAC disabled | Protected Mode: disabled  - Issue does not appear (I can repeat this steps for ages)

 

Used Local Intranet zones.

 

Could anybody explain me such behavior, because it looks strange and should be vice verse.

Could anybody explain me what Protected Mode: ON do and what Protected Mode: OFF do?

 Any help would be greatly appreciated! I have posted this in the IE forums (http://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/issue-with-protected-mode-in-ie8-and-win7/58f53925-916b-4d9d-b71b-dc658b446f15?tm=1331117892164) and been directed here as this might be a more appropriate place to post it.

Thanks in advance.

Answer 1

Hi,

Compare the different default security zone settings when you turn protected mode on and off... Protected mode adds a higher granulation of the default Security Zone settings... It sounds like you have a java applet on your web page.

When testing your web apps you should

You should target Protected Mode as on.

You should target the Default Securit Zone settings... Tools>Internet Options>Security tab, click "Reset all zones to default"

Note the security zone that your site loads in to (File>Properties) ..... You should target the Internet zone.... this is where most public users will see you site in.

You should test placing your site in the Restricted Sites list to test for browsers with no scripting and no applets or activex controls.

Regards.

---

Rob^_^

Answer 2

Hi,

This is corporate tool and application is in corporate network. I've just shown example of typical workflow.

Also, I found that after Log off from application and restart browser I can continue to perform that steps, but again only 5 times. :(

Very strange.

Answer 3

Hi, have you tried with other browsers or with other computers? 

Answer 4

f12>Script tab, click "Start Debugging"

Test in both normal and no-Addons mode... third party popup blockers can alter outcomes in how scripted windows are handled...It will also depend apon the IE Security zone that each dialog maps to (File>Properties or right-click on document, select "Properties")...

Ensure you are using the Default Security Zone settings... always.

Also, I found that after Log off from application and restart browser I can continue to perform that steps, but again only 5 times - your application logoff is not clearing session variables that you may be using to determine the users session state....

You may be using cookie-less asp.net web application.

Your on your own if you can't provide a public link.

Regards.

---

Rob^_^

Answer 5

Hi, have you tried with other browsers or with other computers? 

Yes, I have. Also I can perform this workflow on IE7 and IE9 without any issues. It is appeared only for IE8 and Protected Mode OFF and enabled UAC.

Answer 6

Hi, please try IECUSTOMIZER's suggestion to debug the application.

Answer 7

f12>Script tab, click "Start Debugging"

Test in both normal and no-Addons mode... third party popup blockers can alter outcomes in how scripted windows are handled...It will also depend apon the IE Security zone that each dialog maps to (File>Properties or right-click on document, select "Properties")...

Ensure you are using the Default Security Zone settings... always.

Thank you for advise.

I tried to debug and found that window.confirm("Hello") does not execute after four previous execution. 

Also I have found the same issue on this forum: http://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/ie-8-at-windows-7-64-bit-home-premiumjavascript/d29fc99e-1504-4083-b683-438e32bba46f?tm=1331816513854

Maybe you have any ideas about this?

Answer 8

I have created simple example to reproduce this issue.

testConfirm.html

<html>
<head>
<script type="text/javascript">

function show_modal() {
    var args = new Array();
	args[args.length] = window;
	args[args.length] = this;
    var promoteDialog = window.showModelessDialog( "http://<URL>/modal.html"	,
										args,
										"resizable:yes; status:no; " +
										"dialogHeight:300px; " +
										"dialogWidth:400px;help=no");
}
</script>
</head>
<body>

<input type="button" onclick="show_modal()" value="Display a modal window" />

</body>
</html> 

modal.html

<html>
<head>
<script type="text/javascript">
function disp_confirm()
{
var r= window.confirm("Press a button!")
if (r==true)
  {
  alert("You pressed OK!")
  }
else
  {
  alert("You pressed Cancel!")
  }
}
</script>
</head>
<body>

<input type="button" onclick="disp_confirm()" value="Display a confiramtion window" />

</body>
</html>

Wokrflow:

1. Display a modal window -- > Display a confirmation window --> OK --> OK --> Close Modal window manually
2. Display a modal window -- > Display a confirmation window --> OK --> OK --> Close Modal window manually
3. Display a modal window -- > Display a confirmation window --> OK --> OK --> Close Modal window manually
   
4. Display a modal window -- > Display a confirmation window --> OK --> OK --> Close Modal window manually
   
5. Display a modal window -- > Display a confirmation window --> Confirmation window IS NOT displayed.
   

Required options for reproduce:

• Windows 7 (I have 64-bit operation system)
• Internet Explorer 8
• Enabled UAC (default level)
• Protected Mode: Off
• Pop-up blocker - turned off

Script works fine in next cases:

• on Windows XP
• UAC disabled
• UAC enabled but Protected Mode: On
• Internet Explorer 7
• Internet Explorer 9

Could anybody help me with this?

Added: Also I have found that window.confirm() function works fine outside Modeless Dialog, for example in the normal page.

Answer 9

Hi,

1. add a dtd to your pages and then validate the markup (either F12>Validate>HTML) or by direct input at validator.w3.org

2. Always target the default security zone settings in the IE version you are using... Tools>Internet Options>Security tab, click "Reset all zones to default".... this will be protected mode by default.

3. Always test by running IE in noAddons mode to rule out thrid-party addons. You are using scripted windows (showModalWindow) which can be affected by your IE Popup blocker settings, Your IE Security Zone settings, OR any third-party popup blockers you have installed (turn them off you don't need 2)

4. Test by running on your local IIS server... launching html files from the local disk is not the same as from a web server... (Advanced tab, check "Allow active content to run in files on my computer"

5. Continue to use the IE Developer tool to debug your web pages... you are obviously a beginner.. or ask one of your colleagues or your teacher to help you.

You will find additional resources and links to "How to use the Ie Developer Toolbar" here http://msdn.microsoft.com/en-us/ie/aa740469.aspx

A good place for a beginner web developer to start is http://www.w3schools.com you will find examples there of how to use the showModalDialog method..

---

Rob^_^

Answer 10

Hi,

Thank you for your advices.

But this is simple example of issue (But it is reproducible). I am not allowed to put here code of corporate application. Application works fine during 12 years on IE6, IE7, IE8 on Windows XP. This issue appeared when customer began work on Win7 and IE8, where UAC is enabled and Protected Mode: Off (by default for Local Intranet).

In IE7 and IE9 this issue is not appeared. With the same settings as for IE8.

I'm interesting in IE8 security features and compatibility with javascript.

Especially, why it blocks confirm window from ModelessDialog, and why every time during 5th time.

I believe this is bug inside IE8. I need a workaround of this or logical explanation of such behavior. Because I'm confused why "Protected Mode: Off" blocks confirmation window, when "Protected Mode: On" does not.

Thanks.

Answer 11

there is a security zone setting for "Use popup blocker"... check that both your security zone settings and IE popup blocker settings are the same in all versions of IE... you may have GPO security zone templates that are customized for the Intranet zone... ensure you are using the latest adm templates.

your showModal function is a bit non-standard.... you can pass '' or null as an argument instead of the window object. You do not use the returned args for anything.

function show_modal() {
    var promoteDialog = window.showModelessDialog( "http://<URL>/modal.html"	,
										'',
										"resizable:yes; status:no; " +
										"dialogHeight:300px; " +
										"dialogWidth:400px;help=no");
}

I would imagine that somewhere, because alert is a method of the window object, that the browser looses track of which window object is in scope.

Regards.

---

Rob^_^