Bug 1539598 Require pre-install confirmation on all addons installs from outside about:addons r=kmag
☠☠ backed out by 75d0bd84d83f ☠ ☠
authorAndrew Swan <aswan@mozilla.com>
Wed, 03 Apr 2019 15:30:38 -0700
changeset 467699 7a05ac03465cb38ba5a798cb762ccf20a6635f23
parent 467698 56164d97e3e4594a9ffbcf2f52e24cd65c9b9fe3
child 467700 53f0254dfc7e43bc153bcef26fa3a87fd62b6334
child 467903 a5ba6ffec2a7b6431404bf1d87a67b90a6fe8a35
push id112655
push useraswan@mozilla.com
push dateWed, 03 Apr 2019 23:52:48 +0000
treeherdermozilla-inbound@7a05ac03465c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskmag
bugs1539598
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1539598 Require pre-install confirmation on all addons installs from outside about:addons r=kmag Differential Revision: https://phabricator.services.mozilla.com/D26024
toolkit/mozapps/extensions/AddonManager.jsm
toolkit/mozapps/extensions/test/browser/browser_webapi_theme.js
--- a/toolkit/mozapps/extensions/AddonManager.jsm
+++ b/toolkit/mozapps/extensions/AddonManager.jsm
@@ -2528,17 +2528,17 @@ var AddonManagerInternal = {
 
       // All installs end up in this callback when the add-on is available
       // for installation.  There are numerous different things that can
       // happen from here though.  For webextensions, if the application
       // implements webextension permission prompts, those always take
       // precedence.
       // If this add-on is not a webextension or if the application does not
       // implement permission prompts, no confirmation is displayed for
-      // installs created with mozAddonManager (in which case requireConfirm
+      // installs created from about:addons (in which case requireConfirm
       // is false).
       // In the remaining cases, a confirmation prompt is displayed but the
       // application may override it either by implementing the
       // "@mozilla.org/addons/web-install-prompt;1" contract or by setting
       // the customConfirmationUI preference and responding to the
       // "addon-install-confirmation" notification.  If the application
       // does not implement its own prompt, use the built-in xul dialog.
       if (info.addon.userPermissions && WEBEXT_PERMISSION_PROMPTS) {
@@ -2691,17 +2691,22 @@ var AddonManagerInternal = {
 
       return AddonManagerInternal.getInstallForURL(options.url, {
         hash: options.hash,
         telemetryInfo: {
           source: AddonManager.getInstallSourceFromHost(options.sourceHost),
           method: "amWebAPI",
         },
       }).then(install => {
-        AddonManagerInternal.setupPromptHandler(target, null, install, false, "AMO");
+        let requireConfirm = true;
+        if (target.contentDocument &&
+            target.contentDocument.nodePrincipal.isSystemPrincipal) {
+          requireConfirm = false;
+        }
+        AddonManagerInternal.setupPromptHandler(target, null, install, requireConfirm, "AMO");
 
         let id = this.nextInstall++;
         let {listener, installPromise} = makeListener(id, target.messageManager);
         install.addListener(listener);
 
         this.installs.set(id, {install, target, listener, installPromise});
 
         let result = {id};
--- a/toolkit/mozapps/extensions/test/browser/browser_webapi_theme.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_webapi_theme.js
@@ -16,24 +16,31 @@ add_task(async function test_theme_insta
     function observer(subject, topic, data) {
       updates.push(JSON.stringify(subject.wrappedJSObject));
     }
     Services.obs.addObserver(observer, "lightweight-theme-styling-update");
     registerCleanupFunction(() => {
       Services.obs.removeObserver(observer, "lightweight-theme-styling-update");
     });
 
+    let sawConfirm = false;
+    promisePopupNotificationShown("addon-install-confirmation").then(panel => {
+      sawConfirm = true;
+      panel.button.click();
+    });
 
     let prompt1 = waitAppMenuNotificationShown("addon-installed", "theme@tests.mozilla.org", false);
     let installPromise = ContentTask.spawn(browser, URL, async (url) => {
       let install = await content.navigator.mozAddonManager.createInstall({url});
       return install.install();
     });
     await prompt1;
 
+    ok(sawConfirm, "Confirm notification was displayed before installation");
+
     // Open a new window and test the app menu panel from there.  This verifies the
     // incognito checkbox as well as finishing install in this case.
     let newWin = await BrowserTestUtils.openNewBrowserWindow();
     await waitAppMenuNotificationShown("addon-installed", "theme@tests.mozilla.org", true, newWin);
     await installPromise;
     ok(true, "Theme install completed");
 
     await BrowserTestUtils.closeWindow(newWin);