90986 - Prefrences are ignored for security box pop-ups

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Colin Tisdall]

From Bugzilla Helper:
User-Agent: Mozilla/4.77 [en] (X11; U; Linux 2.2.16-22 i686)
BuildID:    

When going to any banking website a security box will either pop-up before or
after you visit the site even if you disable this in the prefrences.

Reproducible: Always
Steps to Reproduce:
1.Disable pop up security warnings windows in the prefrences 
2.Go to a SSL secure site
3.Leave the site by going to any other or backing out

Actual Results:  Security box will still warn you about the site.

Expected Results:  If the boxes are disabled in the pref's then you should never
see them.

Comment 1

[Asa Dotzler [:asa]]

I think this is reported. over to security

Comment 2

[Mitchell Stoltz (not reading bugmail)]

->PSM. How many Colins are there at oeone?

Comment 3

[Colin Phillips]

The cloneing process has only churned out 2 thus far.

Comment 4

[John Unruh]

WFM. Try a newer build. If you migrated from a 4.7 profile, you could have a 
security warning pref set for which an older build of Mozilla did not have a UI 
to turn off.

Comment 5

[Colin Phillips]

The profile was created by 0.9.2 (4.x was never on this machine).  I dont think
this is the issue.

Comment 6

[John Unruh]

Under Edit>Prefs>Privacy>SSL, there should be 5 checkboxes (with a very recent 
build). Unchecking them should add the following lines to your prefs.js file. 
Once these lines are in the prefs.js file, you should receive no more security 
warnings of this type. This works for me. Reporter, does this help you 
investigate what is happening in your case?

user_pref("security.warn_entering_secure", false);
user_pref("security.warn_entering_weak", false);
user_pref("security.warn_leaving_secure", false);
user_pref("security.warn_submit_insecure", false);
user_pref("security.warn_viewing_mixed", false);

Comment 7

[Colin Phillips]

We ahve all but the following:

user_pref("security.warn_leaving_secure", false);

Would adding that one likely solve this problem?

Comment 8

[Colin Phillips]

Can you try to remove that pref and see if you end up with the same behaviour?

Comment 9

[John Unruh]

I'm sure I would get a security warning if I removed that line from the 
prefs.js. The point is that you should be using a recent build with 5 
checkboxes, not just 4, and that unchecking all 5 should add all 5 lines to the 
prefs.js file. At that point, you should get no more warnings of this type.

Comment 10

[Colin Phillips]

Ahhh, so this only works on builds > 0.9.2 then.

Our code is based on 0.9.2.  We can't move to 0.9.3 until we know it's stable
and adds value to us.  If you can prove that, we'll try it out.

Comment 11

[John Unruh]

Marking verified with the 8/1 WinNT trunk build. Reporter, with 0.9.2, the first 
time you see a security warning, you should be able to turn it off permanently 
by unchecking the box on the dialog itself.