Windows XP SP2 WRSF security feature causes IE to use window. open and window. showModalDialog status = no to close the status bar

Some time ago, I was busy with an asp.net item management system, which used window. showModalDialog () is used to pop up the modal dialog box, where status = no is used to make the dialog box do not display the ugly status bar, but it is found that in the Intranet area is the local network (http: // localhost) the status bar of the Internet region is displayed, but it does not help to change the code. It seems that status = no has no effect. Later, the following information was found on the Microsoft Website:

Data Source Address: http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2brows.mspx#E6SAE

Internet Explorer Using Feature Control Registry Settings with Security Zone SettingsWhat do Feature Control Registry Settings and Security Zone Settings do?

Feature Control registry settings are provided in Windows xp sp 2 so that a specific process can be configured to opt-in to a special security feature. in the following example, Internet Explorer has been configured to use the Windows Restrictions security feature (WRSF ):

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft
\ Internet Explorer \ Main \ FeatureControl
\ FEATURE_WINDOWS_RESTRICTIONS] iexplore.exe = 1

Once a process has been configured to use a security feature, the security feature is running and security zone settings can be applied for more precision, if implemented for that feature. InSecurity SettingsTabInternet Options, The user can adjust these settings for users of the new Windows XP SP2 feature controls. If you selectEnable, It lowers the security settings and allows the behavior to run less securely, or in the same manner as it did in Windows XP Service Pack 1. For example, if Windows Restriction is setEnableIn the Intranet zone, Windows Restrictions willNotBe applied-script-initiated windows can be opened as freely as in Windows XP SP1. The Windows XP SP2 restrictions can be applied again by setting the security zone settingDisable, Which blocks the less-secure behavior while the feature control is enabled for that process.

For example, if the feature is turned on for Windows Restrictions, this feature:

•	Forces the status bar to be present in script-initiated Internet Explorer windows with the title bar [those that were created with window. open ()].
•	Constrains the size and positioning of script-initiated Internet Explorer windows that have title and status bars to ensure that the title bar and the status bar in these windows is always visible to the user.

I deliberately bold the key words into red. It turns out that this is a new security feature of Windows XP SP2 Windows Restrictions security feature (WRSF). To ensure security, SP2 specifically forces the pop-up title bar and status bar to be displayed, allows viewers to know which webpage they are accessing and which webpage to prevent malicious spoofing. This feature is valid for the Internet region and does not work for the local Intramet region. That is to say, it is invalid to use the code status = no control window with no status bar under XP SP2. In addition to modifying the client registry key value, disable the WRSF feature, alternatively, you can add the system site address to the "Local Intranet" area in the "Security" option of the IE attribute on the client. However, this seems to have lost the biggest advantage of the B/S system. As there are so many clients, it is impossible for everyone who uses the system to set this way, so they can only continue to display the status bar.