diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 1d903da7a6ce..b9e7c392dd78 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -126,13 +126,14 @@ nsDocShell::nsDocShell() :
   mViewMode(viewNormal),
   mLastViewMode(viewNormal),
   mRestoreViewMode(PR_FALSE),
+  mBusyFlags(BUSY_FLAGS_NONE),
   mEODForCurrentDocument (PR_FALSE),
   mURIResultedInDocument(PR_FALSE),
   mUseExternalProtocolHandler (PR_FALSE),
+  mDisallowPopupWindows(PR_FALSE),
   mParent(nsnull),
   mTreeOwner(nsnull),
-  mChromeEventHandler(nsnull),
-  mBusyFlags(BUSY_FLAGS_NONE)
+  mChromeEventHandler(nsnull)
 {
   NS_INIT_REFCNT();
 }
@@ -1665,6 +1666,7 @@ NS_IMETHODIMP nsDocShell::Create()
    // i don't want to read this pref in every time we load a url
    // so read it in once here and be done with it...
    mPrefs->GetBoolPref("network.protocols.useSystemDefaults", &mUseExternalProtocolHandler);
+   mPrefs->GetBoolPref("browser.target_new_blocked", &mDisallowPopupWindows);
 
    return NS_OK;
 }
@@ -2148,6 +2150,7 @@ NS_IMETHODIMP nsDocShell::SetCurScrollPos(PRInt32 scrollOrientation,
 
       default:
          NS_ENSURE_TRUE(PR_FALSE, NS_ERROR_INVALID_ARG);
+         x=0; y=0;    // fix compiler warning, not actually executed
       }
 
    NS_ENSURE_SUCCESS(scrollView->ScrollTo(x, y, NS_VMREFRESH_IMMEDIATE),
@@ -3039,6 +3042,32 @@ NS_IMETHODIMP nsDocShell::InternalLoad(nsIURI* aURI, nsIURI* aReferrer,
    PRUint32 aLoadType)
 #endif
 {
+    if (mDisallowPopupWindows && aWindowTarget && aWindowTarget[0] != '\0')
+    {
+        nsXPIDLCString scheme;
+        nsresult rv = aURI->GetScheme(getter_Copies(scheme));
+        if (NS_SUCCEEDED(rv) &&
+            nsCRT::strcmp(scheme, "chrome") &&
+            nsCRT::strcmp(scheme, "resource"))
+        {
+            static const char top[] = "_top";
+            if (!nsCRT::strcmp(aWindowTarget, "_blank") ||
+                !nsCRT::strcmp(aWindowTarget, "_new"))
+            {
+                aWindowTarget = top;
+            }
+            else
+            {
+                nsCOMPtr<nsIDocShellTreeItem> targetDocShell;
+                FindItemWithName(NS_ConvertASCIItoUCS2(aWindowTarget).GetUnicode(),
+                                 NS_STATIC_CAST(nsIInterfaceRequestor*, this),
+                                 getter_AddRefs(targetDocShell));
+                if (!targetDocShell)
+                    aWindowTarget = top;
+            }
+        }
+    }
+
   mURIResultedInDocument = PR_FALSE; // reset the clock...
     // Check to see if the new URI is an anchor in the existing document.
   if ((aLoadType == LOAD_NORMAL ||
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index d3ba4ff054de..1fcee615fdab 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -322,6 +322,9 @@ protected:
    // figured out how to do that yet.
    PRBool                     mUseExternalProtocolHandler;
 
+   // Disallow popping up new windows with target=
+   PRBool                     mDisallowPopupWindows;
+
    /* WEAK REFERENCES BELOW HERE.
    Note these are intentionally not addrefd.  Doing so will create a cycle.
    For that reasons don't use nsCOMPtr.*/
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 033bb916e9a6..f06d80cb8bfd 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -97,6 +97,8 @@ pref("browser.PICS.reenable_for_this_session", false);
 pref("browser.PICS.service.http___home_netscape_com_default_rating.service_enabled", true);
 pref("browser.PICS.service.http___home_netscape_com_default_rating.s", 0);
 
+pref("browser.target_new_blocked", false);
+
 // gfx widgets
 pref("nglayout.widget.mode", 2);
 pref("nglayout.widget.gfxscrollbars", true);