1225433 - Restricted Profiles: Customize 'forbid' page

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Sebastian Kaspari (:sebastian; :pocmo)]

Bug 1216723 will introduce a new 'forbid' page that is shown whenever a page is blocked by our block list (bug 1222377). This bug is about customizing this page to show the information we want.

Comment 1

[Barbara Bermes [:barbara] - NI please!]

Aha card created. https://mozilla.aha.io/features/FENN-375

Comment 2

[Anthony Lam (:antlam) Find me, @antlam on Slack!]

As per the discussion in bug 1222377, I'm also OK keeping it as a page. 

I just don't want to spend too much time on redesigning a page at this moment. But, if we can reuse the design and adjust the messaging, this seems reasonable.

So, I think we should re-purpose the current "blocked" page design and just adjust the messaging. What's the best way to see the current design of this page? I came across http://itisatrap.org/firefox/its-an-attack.html ...

Comment 3

[Barbara Bermes [:barbara] - NI please!]

Currently blocked until we know more from legal.

Comment 4

[Barbara Bermes [:barbara] - NI please!]

(In reply to Barbara Bermes [:barbara] from comment #3)
> Currently blocked until we know more from legal.

Actually, I think the idea of a forbid page won't change, even if we end up with a parent-curated white or black list. so yeah we can keep moving with this.

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: forbidden.png

That's how the page looks like currently.

To see it:
* Go to about:config
* Search for browser.safebrowsing.forbiddenURIs.enabled and set it to "true" 
* Go to http://itisatrap.org/firefox/forbidden.html

Comment 6

[Anthony Lam (:antlam) Find me, @antlam on Slack!]

Lets start with this:

 - Can we go with the grey version? Red seems a bit harsh. I'm not sure a "blocked site" warrants the same level of anxiety as a security concern. 

 - About the copy, I'm also not sure how much flexibility we have WRT legal but maybe they can chime in if this is OK? I'll try to stick to this style as much as possible:

Title: Blocked Site
Body: This Web page at *URL* has been blocked by your Admin profile.

---

Optional: Do we have somewhere we want to direct the user to learn more about why this is happening? If so, we could add a button.

Button: Why was this page blocked?
Button link: SUMO article

NI-ing Sebastian for mock, Barbara for Optional question

Comment 7

[Barbara Bermes [:barbara] - NI please!]

(In reply to Anthony Lam (:antlam) from comment #6)

>  - About the copy, I'm also not sure how much flexibility we have WRT legal
> but maybe they can chime in if this is OK? I'll try to stick to this style
> as much as possible:

Elvin and Matej, what do you guys think?


> 
> Optional: Do we have somewhere we want to direct the user to learn more
> about why this is happening? If so, we could add a button.
> 
> Button: Why was this page blocked?
> Button link: SUMO article

We should definitely provide this as we otherwise leave the user in the dark of what and why and how this is happening.

Comment 8

[Matej Novak [:matej]]

(In reply to Barbara Bermes [:barbara] from comment #7)
> (In reply to Anthony Lam (:antlam) from comment #6)
> 
> >  - About the copy, I'm also not sure how much flexibility we have WRT legal
> > but maybe they can chime in if this is OK? I'll try to stick to this style
> > as much as possible:
> 
> Elvin and Matej, what do you guys think?

I would say "The Web page…" instead of "This…"

I also wonder if there's another way to say "admin profile" that's a little friendlier, but if not, let's at least lowercase "admin."

Thanks.

Comment 9

[Elvin Lee [:ellee] (no longer with Mozilla)]

What makes sense for the 'Forbid' page's text and appearance will need to be informed by the final implementation. It will probably need more information than the Safebrowsing warning (e.g., why it was blocked, who did the blocking, and how the user or the admin can change it, etc.) and that will all depend on implementation.

Comment 10

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: blocked-site-updated.png

This is the page in grey, with updated text and "Why was this page blocked?" button. Currently this button links to the generic FFB page:
https://support.mozilla.org/kb/controlledaccess

Comment 11

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: MozReview Request: Bug 1225433 - (Fennec) Update text and style of "forbidden" page. r?francois

Review commit: https://reviewboard.mozilla.org/r/30193/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/30193/

Comment 12

[Anthony Lam (:antlam) Find me, @antlam on Slack!]

Comment on attachment 8705774 [details]
blocked-site-updated.png

WFM! thanks Sebastian!

Comment 13

[François Marier [:francois]]

Comment on attachment 8705777 [details]
MozReview Request: Bug 1225433 - (Fennec) Update text and style of "forbidden" page. r?francois

https://reviewboard.mozilla.org/r/30193/#review27143

That looks great. Would you mind also updating the equivalent UI on the Desktop side so that they don't diverge?

https://dxr.mozilla.org/mozilla-central/rev/5acc2a44834ce0614f98466475e674517daf0041/browser/base/content/blockedSite.xhtml#133-143
https://dxr.mozilla.org/mozilla-central/rev/5acc2a44834ce0614f98466475e674517daf0041/browser/base/content/blockedSite.xhtml#195-230
https://dxr.mozilla.org/mozilla-central/rev/5acc2a44834ce0614f98466475e674517daf0041/browser/base/content/browser.js#2885-2913
https://dxr.mozilla.org/mozilla-central/rev/5acc2a44834ce0614f98466475e674517daf0041/browser/locales/en-US/chrome/browser/safebrowsing/phishing-afterload-warning-message.dtd#25-27

The reasoning that was used on this bug to make the warning page gentler and more useful also apply to Desktop. Of course, we don't have a Desktop SUMO page, but since the feature is pref'ed OFF, I don't see a problem with linking to the Fennec page until we have one on Desktop.

Comment 14

[Sebastian Kaspari (:sebastian; :pocmo)]

Comment on attachment 8705777 [details]
MozReview Request: Bug 1225433 - (Fennec) Update text and style of "forbidden" page. r?francois

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/30193/diff/1-2/

Comment 15

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: MozReview Request: Bug 1225433 - (Desktop) Update text and style of "forbidden" page. r?francois

Review commit: https://reviewboard.mozilla.org/r/31405/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/31405/

Comment 16

[François Marier [:francois]]

Comment on attachment 8709337 [details]
MozReview Request: Bug 1225433 - (Desktop) Update text and style of "forbidden" page. r?francois

https://reviewboard.mozilla.org/r/31405/#review28219

Comment 17

[François Marier [:francois]]

Comment on attachment 8705777 [details]
MozReview Request: Bug 1225433 - (Fennec) Update text and style of "forbidden" page. r?francois

https://reviewboard.mozilla.org/r/30193/#review28221

Comment 18

[Sebastian Kaspari (:sebastian; :pocmo)]

https://hg.mozilla.org/integration/fx-team/rev/3d4671e701e4d7a5a155dcbe36d505b7293d4481
Bug 1225433 - (Fennec) Update text and style of "forbidden" page. r=francois

https://hg.mozilla.org/integration/fx-team/rev/62fc74be5c7580e753a7c437bb562620ba0fa5ba
Bug 1225433 - (Desktop) Update text and style of "forbidden" page. r=francois

Comment 19

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/3d4671e701e4
https://hg.mozilla.org/mozilla-central/rev/62fc74be5c75

Comment 20

[Stefan Plewako [:stef]]

(In reply to Matej Novak [:matej] from comment #8) 
> I also wonder if there's another way to say "admin profile" that's a little
> friendlier, but if not, let's at least lowercase "admin."

What is "admin profile"?

Comment 21

[Sebastian Kaspari (:sebastian; :pocmo)]

(In reply to Stefan Plewako [:stef] from comment #20)
> What is "admin profile"?

The admin profile is the primary user profile of an Android device:
https://source.android.com/devices/tech/admin/multi-user.html

This admin can create restricted profiles which can be configured to block certain content.

Comment 22

[Stefan Plewako [:stef]]

(In reply to Sebastian Kaspari (:sebastian) from comment #21)
> (In reply to Stefan Plewako [:stef] from comment #20)
> > What is "admin profile"?
> 
> The admin profile is the primary user profile of an Android device:
> https://source.android.com/devices/tech/admin/multi-user.html
> 
> This admin can create restricted profiles which can be configured to block
> certain content.

That is surprising, with "Bug 1225433 - (Desktop) Update text and style of "forbidden" page. r=francois" commit message and safeb.blocked.forbiddenPage.shortDesc entity in browser/locales/en-US/chrome/browser/safebrowsing/phishing-afterload-warning-message.dtd being changed to "The Web page at <span id='forbidden_sitename'/> has been blocked by your admin profile." I would describe the change as poorly worded and done in wrong place really.