Re: Mouse Capture for Canvas

(Hello, Brandon)

On Wed, Feb 9, 2011 at 7:20 PM, Brandon Andrews <
warcraftthreeft@sbcglobal.net> wrote:
> Regarding forcing a user action before the mouse is captured/grabbed I
think it's pivotal. If a page can simply call a method to capture the mouse
everytime it's released it because exploitable. If a person accidently
allows a page to capture their mouse they can just press the release key.

It's only exploitable if there are no other mechanisms to prevent abuse.
Requiring a click isn't the only conceivable way of doing that.

Also, "trusted" applications may want to relax restrictions like this, to
allow web apps to behave more like native applications.

Even if implementations will usually require a click, there's no need to
bolt that into the API and make it impossible to change later on.

> I hate to ask, since there could be use cases I'm missing, but what is a
use case where a browser would need to grab the mouse immediately when the
page starts? I'm not against the idea, but it might need a strategy to stop
abuse. Here are some steps I see happening.

If I load a first-person game in a tab, I shouldn't need to click the window
to allow the page to capture the mouse.  That'll force every game to start
with a superfluous box saying "click here to start".

> Also what are your guy's name ideas? I think I prefer mousecapture and
mouserelease and just push aside the IE API.

"Mouse capture" isn't just an IE API.  There's also a similar Win32 API with
the same name, with the same use case as IE's API: to continue receiving
mouse motion when dragging.  I'm sure there are other windowing systems with
it, too.

I'd suggest "mousegrab".

--
Glenn Maynard