A web page catches Ctrl+Tab

[pepalogik]

I use a web-based CMS which under certain circumstances catches the Ctrl+Tab keystroke, and so I cannot use the keystroke to switch between browser tabs. It is a bug of the CMS, but I think PM should not let the buggy CMS catch the keystroke. The problem does not occur in Firefox.

Can I configure PM so that it will not allow web pages to catch important keystrokes?

Some tech. info:
Pale Moon 28.2.2 (64-bit), build ID 20181206024009
OS Linux Mint 18.2 'Sonya' Xfce 64-bit (kernel 4.8.0-53-generic)
Active browser extensions:

• Context Search X 0.4.6.26
• keyconfig 20110522
• Mouse Gestures Suite 2.5.1
• Pale Moon Commander 2.0.2
• Shift+LeftClick opens links in a new active tab (Need Restart) 1.2
• Speed Start 2.1.3
• Tab Mix Plus 0.5.5.0
• Zoom Page 15.8

[pepalogik]

Well, my problem is solved, because the CMS developer has fixed it. But still, I think that Pale Moon shouldn't allow web pages to usurp important keystrokes. I mean, it is OK if a WYSIWYG editor in a web page catches Ctrl+B and Ctrl+I, but there should be no reason for a web page to catch Ctrl+Tab. As I have remarked already, Firefox did well in my test.

[Moonchild]

A few questions:

• Who decides what are "important" keystrokes?
• Web applications often need tons of freedom to assign keyboard shortcuts because they are supposed to work in all browsers (and browsers have different shortcuts). What would the resulting "available" list of keystrokes be for web applications and is this enough?

[pepalogik]

Who decides what are "important" keystrokes?

There are two suitable approaches:

1. If there is a standard for this, follow it.
2. Place the user in the center of your thinking (rather than a web-app developer). What does the user expect to happen on pressing Ctrl+Tab? Almost certainly, he expects switching to another browser tab. What about Ctrl+U, for example? This is less obvious - some may expect it to underline text, while others may expect it to show the page's source code. However, displaying source code is not a very common operation (unlike switching between browser tabs), and Ctrl+U is often used in rich text editors to underline text. Conclusion: allow pages to catch Ctrl+U.

I understand that the problem is tricky - if there are conflicting keystrokes, a perfect solution does not exist. Apparently the best way to go is to allow users to configure the behavior. This might possibly be accomplished by the keyconfig extension. The ultimate solution would be a per-keystroke configuration, i.e., the user would decide which keystrokes may be intercepted by web pages and which cannot (obviously, a reasonable default configuration would have to be provided). A simpler solution is to add to Preferences a switch like "Allow web pages to override the browser's keyboard shortcuts", i.e., one setting for all keystrokes. Maybe there is a switch like this already somewhere in about:config, but I couldn't find it.

[Moonchild]

If there is a standard for this, follow it.

There obviously isn't.

What does the user expect to happen on pressing Ctrl+Tab? Almost certainly, he expects switching to another browser tab.

That depends very much on the user and what web application he's working in. Many web applications are translations of dedicated systems with their own UIs.

So it really is not clear-cut. Putting the user at the center of the decision making process is impossible because as many users there are, as many workflows and expectations.

[pepalogik]

That depends very much on the user and what web application he's working in.

as many users there are, as many workflows and expectations.

If I understand correctly, you are saying that you cannot make decisions for users. That's fine, but then please provide a way to configure the browser behavior .

Putting the user at the center of the decision making process is impossible

Putting the web-app developer there is no better. Note that there are also malicious developers of malicious web sites, and thus allowing web pages to do anything is not a good policy.

[Isengrim]

There really isn't a clean way of preventing sites from capturing keys using JavaScript without breaking a lot of web functionality in the process.

Perhaps this will help? How to prevent websites from hijacking keyboard shortcuts.

[tooshorttoolong]

I’m not confronted to this problem often but it seems crazy to me that any web page can override the keyboard shortcuts of the browser. It would be great to have an option to only enable this per-site, with a whitelist.

[Isengrim]

I’m not confronted to this problem often but it seems crazy to me that any web page can override the keyboard shortcuts of the browser.

It's a feature of JavaScript, and it's been around quite a while.

It would be great to have an option to only enable this per-site, with a whitelist.

Please re-read my previous post.

[tooshorttoolong]

It's a feature of JavaScript, and it's been around quite a while.

Yes. It’s still crazy.

Please re-read my previous post.

Re-reading your post, however amazingly interesting it may be, does not change the fact that it would be great to have an option to only enable this per-site, with a whitelist.
Actually it seems that recent versions of Firefox have introduced this option (I’m reading FF59, but with a bug preventing DEL and Backspace from working when the option is enabled).

[Moonchild]

Please follow up on Ascrod's post. It has some practical solutions linked to near the bottom of the article that can and will help you make certain key combinations "untouchable" by web page scripts.
I'm unlikely to incorporate another half-broken Mozilla hack in the browser to work around what is established and used on the web. As your own investigation in this matter has shown, web application developers do not intentionally want to break browser operation and will fix bugs short term if brought to their attention. The power is given to the website owners to use this JS feature responsibly.

[pepalogik]

Please follow up on Ascrod's post. It has some practical solutions linked to near the bottom of the article that can and will help you make certain key combinations "untouchable" by web page scripts.

Your instructions were somewhat cryptic. First I had to determine that Ascrod = Isengrim and then what you meant by the "practical solutions". The only solution I could infer is:

1. install Greasemonkey or Guerilla Scripting,
2. install this script and personalize it.

Is this the correct (or best) solution? Which one of the two extensions would you recommend?

As your own investigation in this matter has shown, web application developers (...) will fix bugs short term

This specific developer is paid by the hour for his work on the CMS.

[Isengrim]

Off-topic:

First I had to determine that Ascrod = Isengrim

Yeah, sorry about that...