Bug 1412559 - Make the "confirm repost" prompt tab modal. r=bz
authorJohann Hofmann <jhofmann@mozilla.com>
Wed, 08 Nov 2017 18:26:33 +0100
changeset 444220 818860c42bcaa778c3c88bec897bc7bb1f417f3b
parent 444219 2d6c76ecff8dcb7cfce961885e7e0fa2f1b608c3
child 444221 b9d38c74d5ffdb4353f36ad10a65681d492d340c
push id1618
push userCallek@gmail.com
push dateThu, 11 Jan 2018 17:45:48 +0000
treeherdermozilla-release@882ca853e05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs1412559
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1412559 - Make the "confirm repost" prompt tab modal. r=bz This is done to prevent malicious pages from abusing the feature to lock up the browser. MozReview-Commit-ID: 8Gf55nbMwCu
docshell/base/nsDocShell.cpp
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -13554,16 +13554,22 @@ nsDocShell::ConfirmRepost(bool* aRepost)
     return rv;
   }
 
   rv = appBundle->GetStringFromName("resendButton.label", button0Title);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
+  // Make the repost prompt tab modal to prevent malicious pages from locking
+  // up the browser, see bug 1412559 for an example.
+  if (nsCOMPtr<nsIWritablePropertyBag2> promptBag = do_QueryInterface(prompter)) {
+    promptBag->SetPropertyAsBool(NS_LITERAL_STRING("allowTabModal"), true);
+  }
+
   int32_t buttonPressed;
   // The actual value here is irrelevant, but we can't pass an invalid
   // bool through XPConnect.
   bool checkState = false;
   rv = prompter->ConfirmEx(
     nullptr, msgString.get(),
     (nsIPrompt::BUTTON_POS_0 * nsIPrompt::BUTTON_TITLE_IS_STRING) +
       (nsIPrompt::BUTTON_POS_1 * nsIPrompt::BUTTON_TITLE_CANCEL),