1070115 - In Sync preferences, the manage account link should only link to manage that account

Status: VERIFIED FIXED

(Firefox :: Sync, defect)

Description

[Ryan Feeley [:rfeeley]]

Attachment: manage.gif

Currently in Sync preferences, the Manage link goes to /settings on the web. The URL should contain a hash of an email address that will bring the user to the setting page for that specific account, so that they don't accidentally modify the settings of a different account they had authenticated on the web.

Comment 1

[Chris Karlof [:ckarlof]]

We fixed this in the FxA web code. If you add uid=<fxa uid> to the query params of the settings link, we'll show the correct settings page if the user is currently authenticated on the Web. Otherwise, we'll prompt the user to log in.

Comment 2

[Mark Hammond [:markh] [:mhammond]]

Sounds like a simple but worthwhile fix the client can make.

Comment 3

[Ryan Feeley [:rfeeley]]

Gavin, has this made the priority backlog?

Comment 4

[:Gavin Sharp [email: [e-mail]]]

No, but maybe Mark can write a patch very quickly.

Comment 5

[Ryan Feeley [:rfeeley]]

Would it work for the manage account link in Hello too or should I file a separate bug for that?

Comment 6

[Matthew N. [:MattN]]

That's already filed as bug 1070208 (in the See Also field).

Comment 7

[Mark Hammond [:markh] [:mhammond]]

Attachment: 0001-Bug-1070115-pass-the-uid-of-the-current-FxA-user-to-.patch

Adds a promiseAccountsManageURI to FxAccounts.jsm and has the sync pref's panel call that.

Comment 8

[Zachary Carter [:zaach]]

Comment on attachment 8596940 [details] [diff] [review]
0001-Bug-1070115-pass-the-uid-of-the-current-FxA-user-to-.patch

Review of attachment 8596940 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good with comment addressed.

::: services/fxaccounts/FxAccounts.jsm
@@ +1231,5 @@
> +      if (!accountData) {
> +        return null;
> +      }
> +      let newQueryPortion = url.indexOf("?") == -1 ? "?" : "&";
> +      newQueryPortion += "uid=" + encodeURIComponent(accountData.uid);

We should also add an email query parameter for the fallback scenario: when there's no account with that uid in localStorage we show /signin with the provided email pre-filled.

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/fx-team/rev/d03a3e5aaf86

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d03a3e5aaf86

Comment 11

[Catalin Varga [QA][:VarCat]]

I verified this bug using 
FF 40
Build Id: 20150427030207
OS: Win 7 x64, Mac Os X 10.9.5, Ubuntu 14.04 x64

When pressing the manage button from about:preferences#sync the settings page of the account is opened and the url format contains the email and uid eg: (https://accounts.firefox.com/settings?uid=41276d2ce9aa4b29aa394cb4ee44ceb9&email=cascavaca%40mailinator.com)