Open Bug 1002711 Opened 6 years ago Updated 6 years ago

Authentication state pref remains after panel is uninstalled

Categories

(Firefox for Android :: General, defect)

ARM
Android
defect
Not set

Tracking

()

People

(Reporter: Margaret, Unassigned, Mentored)

References

(Blocks 1 open bug)

Details

(Whiteboard: [lang=js])

An add-on can call Home.panels.setAuthenticated(true), and that will persist as a preference even if the add-on is uninstalled.

Although it should be up to the add-on to call setAuthenticated(false) when it is uninstalled, even calling setAuthenticated(false) will keep a preference stored.

I think we should update the setAuthenticated(false) behavior to clear the pref rather than set it to false. We could also make sure this is called in Home.panels.unregister, but I think that for now we should continue to leave that up to the add-on.
(In reply to :Margaret Leibovic from comment #0)
> An add-on can call Home.panels.setAuthenticated(true), and that will persist
> as a preference even if the add-on is uninstalled.
> 
> Although it should be up to the add-on to call setAuthenticated(false) when
> it is uninstalled, even calling setAuthenticated(false) will keep a
> preference stored.
> 
> I think we should update the setAuthenticated(false) behavior to clear the
> pref rather than set it to false. We could also make sure this is called in
> Home.panels.unregister, but I think that for now we should continue to leave
> that up to the add-on.

Strictly speaking, a panel may call unregister() on a, say, app shutdown (it doesn't happen in Fennec because we don't care about app shutdowns due to Android's background killing behaviour). So, I'd say we should only clear the authentication state if the panel actually gets uninstalled from about:home i.e. a Home.panels.uninstall() call.
To fix this bug, I think we should just do what I suggested to clear the authentication pref in setAuthenticated:
http://mxr.mozilla.org/mozilla-central/source/mobile/android/modules/Home.jsm#456

We can leave it up to the add-on to clear the authentication when the panel is uninstalled.
Summary: Authentication state persists after panel is unregistered → Authentication state pref remains after panel is uninstalled
Whiteboard: [mentor=margaret][lang=js]
(In reply to :Margaret Leibovic from comment #2)
> To fix this bug, I think we should just do what I suggested to clear the
> authentication pref in setAuthenticated:
> http://mxr.mozilla.org/mozilla-central/source/mobile/android/modules/Home.
> jsm#456
> 
> We can leave it up to the add-on to clear the authentication when the panel
> is uninstalled.

Maybe we could ensure the pref is removed when the addon requests a panel to be removed? Here:
http://dxr.mozilla.org/mozilla-central/source/mobile/android/base/home/HomePanelsManager.java#159
(In reply to Lucas Rocha (:lucasr) from comment #3)
> (In reply to :Margaret Leibovic from comment #2)
> > To fix this bug, I think we should just do what I suggested to clear the
> > authentication pref in setAuthenticated:
> > http://mxr.mozilla.org/mozilla-central/source/mobile/android/modules/Home.
> > jsm#456
> > 
> > We can leave it up to the add-on to clear the authentication when the panel
> > is uninstalled.
> 
> Maybe we could ensure the pref is removed when the addon requests a panel to
> be removed? Here:
> http://dxr.mozilla.org/mozilla-central/source/mobile/android/base/home/
> HomePanelsManager.java#159

That sounds like a good idea, and saves the add-on from needing to do something else to clean up after itself. If we want to do this in JS, we can do it here:
http://dxr.mozilla.org/mozilla-central/source/mobile/android/modules/Home.jsm#268
Mentor: margaret.leibovic
Whiteboard: [mentor=margaret][lang=js] → [lang=js]
You need to log in before you can comment on or make changes to this bug.