wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1217156 - Add a pref to turn on/off insecure password warnings. Keep it on for Nightly and off for other builds. Will be turned on for dev edition after a few bug fixes. r=bgrins

Browse Source
This commit is contained in:
Tanvi Vyas 2015-10-29 17:01:22 -07:00
parent 7ccb15930d
commit 29e1a19e70
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
browser/app/profile/firefox.js
View File

@ -1430,6 +1430,13 @@ pref("dom.identity.enabled", false);
// Block insecure active content on https pages // Block insecure active content on https pages
pref("security.mixed_content.block_active_content", true); pref("security.mixed_content.block_active_content", true);
// Show degraded UI for http pages with password fields
#ifdef NIGHTLY_BUILD
pref("security.insecure_password.ui.enabled", true);
#else
pref("security.insecure_password.ui.enabled", false);
#endif
// 1 = allow MITM for certificate pinning checks. // 1 = allow MITM for certificate pinning checks.
pref("security.cert_pinning.enforcement_level", 1); pref("security.cert_pinning.enforcement_level", 1);

11
browser/base/content/browser.js
View File

@ -6927,6 +6927,13 @@ var gIdentityHandler = {
return this._state & Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT; return this._state & Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT;
}, },
get _hasInsecureLoginForms() {
// checks if the page has been flagged for an insecure login. Also checks
// if the pref to degrade the UI is set to true
return LoginManagerParent.hasInsecureLoginForms(gBrowser.selectedBrowser) &&
Services.prefs.getBoolPref("security.insecure_password.ui.enabled");
},
// smart getters // smart getters
get _identityPopup () { get _identityPopup () {
delete this._identityPopup; delete this._identityPopup;
@ -7257,7 +7264,7 @@ var gIdentityHandler = {
this._identityBox.classList.add("weakCipher"); this._identityBox.classList.add("weakCipher");
} }
} }
if (LoginManagerParent.hasInsecureLoginForms(gBrowser.selectedBrowser)) { if (this._hasInsecureLoginForms) {
// Insecure login forms can only be present on "unknown identity" // Insecure login forms can only be present on "unknown identity"
// pages, either already insecure or with mixed active content loaded. // pages, either already insecure or with mixed active content loaded.
this._identityBox.classList.add("insecureLoginForms"); this._identityBox.classList.add("insecureLoginForms");
@ -7301,7 +7308,7 @@ var gIdentityHandler = {
// Determine if there are insecure login forms. // Determine if there are insecure login forms.
let loginforms = "secure"; let loginforms = "secure";
if (LoginManagerParent.hasInsecureLoginForms(gBrowser.selectedBrowser)) { if (this._hasInsecureLoginForms) {
loginforms = "insecure"; loginforms = "insecure";
} }

4
browser/base/content/test/general/browser_insecureLoginForms.js
View File

@ -18,6 +18,10 @@ function waitForInsecureLoginFormsStateChange(browser, count) {
* Checks the insecure login forms logic for the identity block. * Checks the insecure login forms logic for the identity block.
*/ */
add_task(function* test_simple() { add_task(function* test_simple() {
yield new Promise(resolve => SpecialPowers.pushPrefEnv({
"set": [["security.insecure_password.ui.enabled", true]],
}, resolve));
for (let scheme of ["http", "https"]) { for (let scheme of ["http", "https"]) {
let tab = gBrowser.addTab(scheme + testUrlPath + "form_basic.html"); let tab = gBrowser.addTab(scheme + testUrlPath + "form_basic.html");
let browser = tab.linkedBrowser; let browser = tab.linkedBrowser;