mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Backout a0b3af4ac9f5 (bug 735280) due to Android jsreftest orange.
This commit is contained in:
parent
46b2d1ab44
commit
3d3d4922c1
@ -5,14 +5,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=246699
|
||||
-->
|
||||
<head>
|
||||
<title>Test for Bug 246699</title>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=246699">Mozilla Bug 246699</a>
|
||||
<p id="display"></p>
|
||||
<div id="content" style="display: none">
|
||||
<iframe id="load-frame"></iframe>
|
||||
<iframe id="load-frame"></iframe>
|
||||
</div>
|
||||
<pre id="test">
|
||||
<script class="testbody" type="text/javascript">
|
||||
@ -21,14 +21,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=246699
|
||||
** Test for Bug 246699
|
||||
** (should produce stack information for caps errors)
|
||||
**/
|
||||
function isError(e)
|
||||
{
|
||||
return e.constructor.name === "Error" || e.constructor.name === "TypeError";
|
||||
}
|
||||
|
||||
function hasStack(e)
|
||||
{
|
||||
return isError(e) && /inciteCaps/.test(e.stack);
|
||||
return e.constructor.name === "Error" && /inciteCaps/.test(e.stack);
|
||||
}
|
||||
|
||||
function inciteCaps(f)
|
||||
|
@ -52,7 +52,7 @@ if (typeof window == 'undefined')
|
||||
}
|
||||
else
|
||||
{
|
||||
expect = /(Script error.|Permission denied to access property 'classes')/;
|
||||
expect = /(Script error.|Permission denied for <file:\/\/> to get property XPCComponents.classes)/;
|
||||
|
||||
window._onerror = window.onerror;
|
||||
window.onerror = (function (msg, page, line) {
|
||||
@ -64,8 +64,7 @@ else
|
||||
|
||||
gDelayTestDriverEnd = true;
|
||||
|
||||
// Trying to set Components.classes will trigger a Permission denied exception
|
||||
window.location="javascript:Components.classes = 42";
|
||||
window.location="javascript:Components.classes";
|
||||
actual = 'No Error';
|
||||
}
|
||||
|
||||
|
@ -60,7 +60,6 @@
|
||||
#include "nsContentUtils.h"
|
||||
#include "jsgc.h"
|
||||
#include "jsfriendapi.h"
|
||||
#include "AccessCheck.h"
|
||||
#include "mozilla/dom/bindings/Utils.h"
|
||||
|
||||
using namespace mozilla;
|
||||
@ -4194,8 +4193,7 @@ NS_IMETHODIMP
|
||||
nsXPCComponents::GetHelperForLanguage(PRUint32 language,
|
||||
nsISupports **retval)
|
||||
{
|
||||
*retval = static_cast<nsIXPCComponents*>(this);
|
||||
NS_ADDREF(this);
|
||||
*retval = nsnull;
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
@ -4247,9 +4245,8 @@ nsXPCComponents::GetClassIDNoAlloc(nsCID *aClassIDNoAlloc)
|
||||
return NS_ERROR_NOT_AVAILABLE;
|
||||
}
|
||||
|
||||
nsXPCComponents::nsXPCComponents(XPCWrappedNativeScope* aScope)
|
||||
: mScope(aScope),
|
||||
mInterfaces(nsnull),
|
||||
nsXPCComponents::nsXPCComponents()
|
||||
: mInterfaces(nsnull),
|
||||
mInterfacesByID(nsnull),
|
||||
mClasses(nsnull),
|
||||
mClassesByID(nsnull),
|
||||
@ -4259,7 +4256,6 @@ nsXPCComponents::nsXPCComponents(XPCWrappedNativeScope* aScope)
|
||||
mConstructor(nsnull),
|
||||
mUtils(nsnull)
|
||||
{
|
||||
MOZ_ASSERT(aScope, "aScope must not be null");
|
||||
}
|
||||
|
||||
nsXPCComponents::~nsXPCComponents()
|
||||
@ -4343,7 +4339,6 @@ nsXPCComponents::GetManager(nsIComponentManager * *aManager)
|
||||
#define XPC_MAP_WANT_NEWRESOLVE
|
||||
#define XPC_MAP_WANT_GETPROPERTY
|
||||
#define XPC_MAP_WANT_SETPROPERTY
|
||||
#define XPC_MAP_WANT_PRECREATE
|
||||
#define XPC_MAP_FLAGS nsIXPCScriptable::ALLOW_PROP_MODS_DURING_RESOLVE
|
||||
#include "xpc_map_end.h" /* This will #undef the above */
|
||||
|
||||
@ -4432,20 +4427,16 @@ nsXPCComponents::SetProperty(nsIXPConnectWrappedNative *wrapper,
|
||||
|
||||
// static
|
||||
JSBool
|
||||
nsXPCComponents::AttachComponentsObject(XPCCallContext& ccx,
|
||||
XPCWrappedNativeScope* aScope,
|
||||
JSObject* aGlobal)
|
||||
nsXPCComponents::AttachNewComponentsObject(XPCCallContext& ccx,
|
||||
XPCWrappedNativeScope* aScope,
|
||||
JSObject* aGlobal)
|
||||
{
|
||||
if (!aGlobal)
|
||||
return false;
|
||||
|
||||
nsXPCComponents* components = aScope->GetComponents();
|
||||
if (!components) {
|
||||
components = new nsXPCComponents(aScope);
|
||||
if (!components)
|
||||
return false;
|
||||
aScope->SetComponents(components);
|
||||
}
|
||||
nsXPCComponents* components = new nsXPCComponents();
|
||||
if (!components)
|
||||
return false;
|
||||
|
||||
nsCOMPtr<nsIXPCComponents> cholder(components);
|
||||
|
||||
@ -4461,14 +4452,15 @@ nsXPCComponents::AttachComponentsObject(XPCCallContext& ccx,
|
||||
if (!wrapper)
|
||||
return false;
|
||||
|
||||
aScope->SetComponents(components);
|
||||
|
||||
jsid id = ccx.GetRuntime()->GetStringID(XPCJSRuntime::IDX_COMPONENTS);
|
||||
JSObject* obj = wrapper->GetSameCompartmentSecurityWrapper(ccx);
|
||||
if (!wrapper)
|
||||
return false;
|
||||
|
||||
return JS_DefinePropertyById(ccx, aGlobal, id, OBJECT_TO_JSVAL(obj),
|
||||
nsnull, nsnull,
|
||||
JSPROP_PERMANENT | JSPROP_READONLY);
|
||||
JSObject* obj;
|
||||
|
||||
return NS_SUCCEEDED(wrapper->GetJSObject(&obj)) &&
|
||||
obj && JS_DefinePropertyById(ccx, aGlobal, id, OBJECT_TO_JSVAL(obj),
|
||||
nsnull, nsnull,
|
||||
JSPROP_PERMANENT | JSPROP_READONLY);
|
||||
}
|
||||
|
||||
/* void lookupMethod (); */
|
||||
@ -4536,15 +4528,3 @@ nsXPCComponents::CanSetProperty(const nsIID * iid, const PRUnichar *propertyName
|
||||
*_retval = nsnull;
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsXPCComponents::PreCreate(nsISupports *nativeObj, JSContext *cx, JSObject *globalObj, JSObject **parentObj)
|
||||
{
|
||||
// this should never happen
|
||||
if (!mScope) {
|
||||
NS_WARNING("mScope must not be null when nsXPCComponents::PreCreate is called");
|
||||
return NS_ERROR_FAILURE;
|
||||
}
|
||||
*parentObj = mScope->GetGlobalJSObject();
|
||||
return NS_OK;
|
||||
}
|
@ -1683,8 +1683,6 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
|
||||
JSObject *ww = wrapper->GetWrapper();
|
||||
if (ww) {
|
||||
JSObject *newwrapper;
|
||||
MOZ_ASSERT(!xpc::WrapperFactory::IsComponentsObject(flat),
|
||||
"Components object should never get here");
|
||||
if (xpc::WrapperFactory::IsLocationObject(flat)) {
|
||||
newwrapper = xpc::WrapperFactory::WrapLocationObject(ccx, newobj);
|
||||
if (!newwrapper)
|
||||
@ -2242,10 +2240,6 @@ XPCWrappedNative::GetSameCompartmentSecurityWrapper(JSContext *cx)
|
||||
wrapper = xpc::WrapperFactory::WrapSOWObject(cx, flat);
|
||||
if (!wrapper)
|
||||
return NULL;
|
||||
} else if (xpc::WrapperFactory::IsComponentsObject(flat)) {
|
||||
wrapper = xpc::WrapperFactory::WrapComponentsObject(cx, flat);
|
||||
if (!wrapper)
|
||||
return NULL;
|
||||
}
|
||||
|
||||
// If we made a wrapper, cache it and return it.
|
||||
|
@ -190,15 +190,11 @@ XPCWrappedNativeScope::IsDyingScope(XPCWrappedNativeScope *scope)
|
||||
void
|
||||
XPCWrappedNativeScope::SetComponents(nsXPCComponents* aComponents)
|
||||
{
|
||||
NS_IF_ADDREF(aComponents);
|
||||
NS_IF_RELEASE(mComponents);
|
||||
mComponents = aComponents;
|
||||
}
|
||||
|
||||
nsXPCComponents*
|
||||
XPCWrappedNativeScope::GetComponents()
|
||||
{
|
||||
return mComponents;
|
||||
}
|
||||
|
||||
// Dummy JS class to let wrappers w/o an xpc prototype share
|
||||
// scopes. By doing this we avoid allocating a new scope for every
|
||||
// wrapper on creation of the wrapper, and most wrappers won't need
|
||||
@ -312,14 +308,9 @@ XPCWrappedNativeScope::~XPCWrappedNativeScope()
|
||||
if (mContext)
|
||||
mContext->RemoveScope(this);
|
||||
|
||||
// This should not be necessary, since the Components object should die
|
||||
// with the scope but just in case.
|
||||
if (mComponents)
|
||||
mComponents->mScope = nsnull;
|
||||
|
||||
// XXX we should assert that we are dead or that xpconnect has shutdown
|
||||
// XXX might not want to do this at xpconnect shutdown time???
|
||||
mComponents = nsnull;
|
||||
NS_IF_RELEASE(mComponents);
|
||||
|
||||
JSRuntime *rt = mRuntime->GetJSRuntime();
|
||||
mGlobalJSObject.finalize(rt);
|
||||
@ -915,7 +906,7 @@ XPCWrappedNativeScope::DebugDump(PRInt16 depth)
|
||||
XPC_LOG_INDENT();
|
||||
XPC_LOG_ALWAYS(("mRuntime @ %x", mRuntime));
|
||||
XPC_LOG_ALWAYS(("mNext @ %x", mNext));
|
||||
XPC_LOG_ALWAYS(("mComponents @ %x", mComponents.get()));
|
||||
XPC_LOG_ALWAYS(("mComponents @ %x", mComponents));
|
||||
XPC_LOG_ALWAYS(("mGlobalJSObject @ %x", mGlobalJSObject.get()));
|
||||
XPC_LOG_ALWAYS(("mPrototypeJSObject @ %x", mPrototypeJSObject.get()));
|
||||
XPC_LOG_ALWAYS(("mPrototypeNoHelper @ %x", mPrototypeNoHelper));
|
||||
|
@ -1020,7 +1020,7 @@ nsXPConnect::InitClasses(JSContext * aJSContext, JSObject * aGlobalJSObj)
|
||||
|
||||
scope->RemoveWrappedNativeProtos();
|
||||
|
||||
if (!nsXPCComponents::AttachComponentsObject(ccx, scope, aGlobalJSObj))
|
||||
if (!nsXPCComponents::AttachNewComponentsObject(ccx, scope, aGlobalJSObj))
|
||||
return UnexpectedFailure(NS_ERROR_FAILURE);
|
||||
|
||||
if (XPCPerThreadData::IsMainThread(ccx)) {
|
||||
@ -1222,7 +1222,7 @@ nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext * aJSContext,
|
||||
|
||||
if (!(aFlags & nsIXPConnect::OMIT_COMPONENTS_OBJECT)) {
|
||||
// XPCCallContext gives us an active request needed to save/restore.
|
||||
if (!nsXPCComponents::AttachComponentsObject(ccx, wrappedGlobal->GetScope(), global))
|
||||
if (!nsXPCComponents::AttachNewComponentsObject(ccx, wrappedGlobal->GetScope(), global))
|
||||
return UnexpectedFailure(NS_ERROR_FAILURE);
|
||||
|
||||
if (XPCPerThreadData::IsMainThread(ccx)) {
|
||||
|
@ -1594,7 +1594,6 @@ public:
|
||||
IsDyingScope(XPCWrappedNativeScope *scope);
|
||||
|
||||
void SetComponents(nsXPCComponents* aComponents);
|
||||
nsXPCComponents *GetComponents();
|
||||
void SetGlobal(XPCCallContext& ccx, JSObject* aGlobal, nsISupports* aNative);
|
||||
|
||||
static void InitStatics() { gScopes = nsnull; gDyingScopes = nsnull; }
|
||||
@ -1644,7 +1643,7 @@ private:
|
||||
Native2WrappedNativeMap* mWrappedNativeMap;
|
||||
ClassInfo2WrappedNativeProtoMap* mWrappedNativeProtoMap;
|
||||
ClassInfo2WrappedNativeProtoMap* mMainThreadWrappedNativeProtoMap;
|
||||
nsRefPtr<nsXPCComponents> mComponents;
|
||||
nsXPCComponents* mComponents;
|
||||
XPCWrappedNativeScope* mNext;
|
||||
// The JS global object for this scope. If non-null, this will be the
|
||||
// default parent for the XPCWrappedNatives that have us as the scope,
|
||||
@ -3888,21 +3887,19 @@ public:
|
||||
|
||||
public:
|
||||
static JSBool
|
||||
AttachComponentsObject(XPCCallContext& ccx,
|
||||
XPCWrappedNativeScope* aScope,
|
||||
JSObject* aGlobal);
|
||||
AttachNewComponentsObject(XPCCallContext& ccx,
|
||||
XPCWrappedNativeScope* aScope,
|
||||
JSObject* aGlobal);
|
||||
|
||||
void SystemIsBeingShutDown() {ClearMembers();}
|
||||
|
||||
virtual ~nsXPCComponents();
|
||||
|
||||
private:
|
||||
nsXPCComponents(XPCWrappedNativeScope* aScope);
|
||||
nsXPCComponents();
|
||||
void ClearMembers();
|
||||
|
||||
private:
|
||||
friend class XPCWrappedNativeScope;
|
||||
XPCWrappedNativeScope* mScope;
|
||||
nsXPCComponents_Interfaces* mInterfaces;
|
||||
nsXPCComponents_InterfacesByID* mInterfacesByID;
|
||||
nsXPCComponents_Classes* mClasses;
|
||||
|
@ -1,43 +0,0 @@
|
||||
function run_test() {
|
||||
var Cu = Components.utils;
|
||||
var sb1 = Cu.Sandbox("http://www.blah.com");
|
||||
var sb2 = Cu.Sandbox("http://www.blah.com");
|
||||
var sb3 = Cu.Sandbox(this);
|
||||
var sb4 = Cu.Sandbox("http://www.other.com");
|
||||
var rv;
|
||||
|
||||
// non-chrome accessing chrome Components
|
||||
sb1.C = Components;
|
||||
rv = Cu.evalInSandbox("C.utils", sb1);
|
||||
do_check_eq(rv, undefined);
|
||||
rv = Cu.evalInSandbox("C.interfaces", sb1);
|
||||
do_check_neq(rv, undefined);
|
||||
|
||||
// non-chrome accessing own Components
|
||||
rv = Cu.evalInSandbox("Components.utils", sb1);
|
||||
do_check_eq(rv, undefined);
|
||||
rv = Cu.evalInSandbox("Components.interfaces", sb1);
|
||||
do_check_neq(rv, undefined);
|
||||
|
||||
// non-chrome same origin
|
||||
var C2 = Cu.evalInSandbox("Components", sb2);
|
||||
do_check_neq(rv, C2.utils);
|
||||
sb1.C2 = C2;
|
||||
rv = Cu.evalInSandbox("C2.utils", sb1);
|
||||
do_check_eq(rv, undefined);
|
||||
rv = Cu.evalInSandbox("C2.interfaces", sb1);
|
||||
do_check_neq(rv, undefined);
|
||||
|
||||
// chrome accessing chrome
|
||||
sb3.C = Components;
|
||||
rv = Cu.evalInSandbox("C.utils", sb3);
|
||||
do_check_eq(rv, Cu);
|
||||
|
||||
// non-chrome cross origin
|
||||
sb4.C2 = C2;
|
||||
rv = Cu.evalInSandbox("C2.interfaces", sb1);
|
||||
do_check_neq(rv, undefined);
|
||||
rv = Cu.evalInSandbox("C2.utils", sb1);
|
||||
do_check_eq(rv, undefined);
|
||||
|
||||
}
|
@ -25,4 +25,3 @@ fail-if = os == "android"
|
||||
[test_unload.js]
|
||||
[test_attributes.js]
|
||||
[test_params.js]
|
||||
[test_components.js]
|
||||
|
@ -607,29 +607,4 @@ ExposedPropertiesOnly::check(JSContext *cx, JSObject *wrapper, jsid id, Wrapper:
|
||||
return true; // Allow
|
||||
}
|
||||
|
||||
bool
|
||||
ComponentsObjectPolicy::check(JSContext *cx, JSObject *wrapper, jsid id, Wrapper::Action act,
|
||||
Permission &perm)
|
||||
{
|
||||
perm = DenyAccess;
|
||||
JSAutoEnterCompartment ac;
|
||||
if (!ac.enter(cx, wrapper))
|
||||
return false;
|
||||
|
||||
if (JSID_IS_STRING(id) && act == Wrapper::GET) {
|
||||
JSFlatString *flatId = JSID_TO_FLAT_STRING(id);
|
||||
if (JS_FlatStringEqualsAscii(flatId, "isSuccessCode") ||
|
||||
JS_FlatStringEqualsAscii(flatId, "lookupMethod") ||
|
||||
JS_FlatStringEqualsAscii(flatId, "interfaces") ||
|
||||
JS_FlatStringEqualsAscii(flatId, "interfacesByID") ||
|
||||
JS_FlatStringEqualsAscii(flatId, "results"))
|
||||
{
|
||||
perm = PermitPropertyAccess;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return PermitIfUniversalXPConnect(cx, id, act, perm); // Deny
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -175,10 +175,4 @@ struct ExposedPropertiesOnly : public Policy {
|
||||
Permission &perm);
|
||||
};
|
||||
|
||||
// Components specific policy
|
||||
struct ComponentsObjectPolicy : public Policy {
|
||||
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act,
|
||||
Permission &perm);
|
||||
};
|
||||
|
||||
}
|
||||
|
@ -151,10 +151,7 @@ FilteringWrapper<Base, Policy>::enter(JSContext *cx, JSObject *wrapper, jsid id,
|
||||
LocationPolicy>
|
||||
#define XLW FilteringWrapper<XrayWrapper<CrossCompartmentSecurityWrapper>, \
|
||||
LocationPolicy>
|
||||
#define CW FilteringWrapper<SameCompartmentSecurityWrapper, \
|
||||
ComponentsObjectPolicy>
|
||||
#define XCW FilteringWrapper<CrossCompartmentSecurityWrapper, \
|
||||
ComponentsObjectPolicy>
|
||||
|
||||
template<> SOW SOW::singleton(WrapperFactory::SCRIPT_ACCESS_ONLY_FLAG |
|
||||
WrapperFactory::SOW_FLAG);
|
||||
template<> SCSOW SCSOW::singleton(WrapperFactory::SCRIPT_ACCESS_ONLY_FLAG |
|
||||
@ -171,9 +168,6 @@ template<> NNXOW NNXOW::singleton(WrapperFactory::SCRIPT_ACCESS_ONLY_FLAG |
|
||||
template<> LW LW::singleton(WrapperFactory::SHADOWING_FORBIDDEN);
|
||||
template<> XLW XLW::singleton(WrapperFactory::SHADOWING_FORBIDDEN);
|
||||
|
||||
template<> CW CW::singleton(0);
|
||||
template<> XCW XCW::singleton(0);
|
||||
|
||||
template class SOW;
|
||||
template class COW;
|
||||
template class XOW;
|
||||
|
@ -366,9 +366,6 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
|
||||
wrapper = &FilteringWrapper<XrayProxy, CrossOriginAccessiblePropertiesOnly>::singleton;
|
||||
} else if (mozilla::dom::bindings::IsDOMClass(JS_GetClass(obj))) {
|
||||
wrapper = &FilteringWrapper<XrayDOM, CrossOriginAccessiblePropertiesOnly>::singleton;
|
||||
} else if (IsComponentsObject(obj)) {
|
||||
wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
|
||||
ComponentsObjectPolicy>::singleton;
|
||||
} else {
|
||||
wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
|
||||
ExposedPropertiesOnly>::singleton;
|
||||
@ -403,9 +400,6 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
|
||||
if (AccessCheck::needsSystemOnlyWrapper(obj)) {
|
||||
wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
|
||||
OnlyIfSubjectIsSystem>::singleton;
|
||||
} else if (IsComponentsObject(obj)) {
|
||||
wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
|
||||
ComponentsObjectPolicy>::singleton;
|
||||
} else if (!targetdata || !targetdata->wantXrays ||
|
||||
(type = GetXrayType(obj)) == NotXray) {
|
||||
// Do the double-wrapping if need be.
|
||||
@ -530,21 +524,4 @@ WrapperFactory::WrapSOWObject(JSContext *cx, JSObject *obj)
|
||||
return wrapperObj;
|
||||
}
|
||||
|
||||
bool
|
||||
WrapperFactory::IsComponentsObject(JSObject *obj)
|
||||
{
|
||||
const char *name = js::GetObjectClass(obj)->name;
|
||||
return name[0] == 'n' && !strcmp(name, "nsXPCComponents");
|
||||
}
|
||||
|
||||
JSObject *
|
||||
WrapperFactory::WrapComponentsObject(JSContext *cx, JSObject *obj)
|
||||
{
|
||||
JSObject *wrapperObj =
|
||||
Wrapper::New(cx, obj, JS_GetPrototype(obj), JS_GetGlobalForObject(cx, obj),
|
||||
&FilteringWrapper<SameCompartmentSecurityWrapper, ComponentsObjectPolicy>::singleton);
|
||||
|
||||
return wrapperObj;
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -110,12 +110,6 @@ class WrapperFactory {
|
||||
|
||||
// Wrap a (same compartment) object in a SOW.
|
||||
static JSObject *WrapSOWObject(JSContext *cx, JSObject *obj);
|
||||
|
||||
// Return true if this is a Components object.
|
||||
static bool IsComponentsObject(JSObject *obj);
|
||||
|
||||
// Wrap a (same compartment) Components object.
|
||||
static JSObject *WrapComponentsObject(JSContext *cx, JSObject *obj);
|
||||
};
|
||||
|
||||
extern js::Wrapper WaiveXrayWrapperWrapper;
|
||||
|
Loading…
Reference in New Issue
Block a user