Internet Explorer provides the capability for scripts to programmatically open additional windows of various types, and to ...

Internet Explorer provides the capability for scripts to programmatically open additional windows of various types, and to resize and reposition existing windows. The Window Restrictions security feature restricts two types of script-initiated windows that have been used by malicious persons to deceive users: popup windows (which do not have components such as the address bar, title bar, status bar, and toolbars) and windows that include the title bar and status bar.

Script-initiated windows with the title bar and status bar are constrained in scripted movement to ensure that these important and informative bars remain visible after the operation completes.

- Scripts cannot position windows so that the title bar or address bar are above the visible top of the display.
- Scripts cannot position windows such that the status bar is below the visible bottom of the display.
- Script-initiated windows that include a title bar and status bar are constrained in scripted sizing to ensure that the title bar and status bar remain visible after the operation completes.
- Scripts cannot resize windows such that the title bar, address bar, or status bar cannot be seen.
- When creating a window, the definition of the fullscreen=yes specification is changed to mean "show the window as maximized," which will keep the title bar, address bar, and status bar visible.

Internet Explorer has been modified to not turn off the status bar for any windows. The status bar is always visible for all Internet Explorer windows.

Script-initiated popup windows are now constrained so that they:

- Do not extend above the top or below the bottom of the parent Internet Explorer Web Object Control (WebOC) window.
- Are smaller in height than the parent WebOC window.
- Overlap the parent window horizontally.
- Stay with the parent window if the parent window moves.
- Appear above its parent so other windows (such as a dialog box) cannot be hidden.