1013165 - Add "allow clipboard access" preference to Page Info > permissions

Status: RESOLVED WONTFIX

(Firefox :: Settings UI, defect)

Description

[Hallvord R. M. Steen [:hallvors]]

The clipboard events spec expects UAs to have UI for granting sites read (&write) access to clipboard. Firefox used to have prefs in about:config for this (CAPS allowclipboard policy) but those are being removed and the UI wasn't great.

We should 
1) Create a site-specific pref that grants access to clipboard
2) Expose this in about:permissions
3) Preferably also implement one of those yellow notification bars saying "Do you want to give site x access to your clipboard?" and allow users to set the pref directly from that UI without going through about:permissions.

The installer should probably have a mechanism to translate old CAPS prefs for clipboard to new site-specific prefs when Firefox is updated.

Steps 1 and 2 are somewhat urgent - this is a regression from users' point of view. See bug 1004260 for background - this is important.

Spec: 
http://dev.w3.org/2006/webapi/clipops/clipops.html#privacy-concerns

Comment 1

[Kohei Yoshino [:kohei]]

Bug 1004260 has been WONTFIXed. Let's track this for Firefox 31, the next ESR.

Comment 2

[Dão Gottwald [:dao]]

about:permissions is unfinished UI that we don't expose to users, so there's no point in tracking this.

If you want end users to actually see that permission in Firefox 31, you'll need to add it to Page Info > Permissions.

Comment 3

[Hallvord R. M. Steen [:hallvors]]

Fine, let's make it about Page Info -> Permissions then

Comment 4

[Jesse Ruderman]

I agree with Chris Palmer in thinking this is a bad idea: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/3QL6mAhC3Lw/t02Uym1B66wJ

Would this pref control copy(+cut), paste, or both? Fwiw, bug 1012662 suggests allowing copy(+cut) for all sites by default.

Comment 5

[(no longer active)]

Prompting the user for this is not a good solution.  We don't really need to prompt any way for copying.  For pasting, there is a good chance that just supporting Cmd+V + the paste event may be enough for everyone.

WONTFIXing this for now...

Comment 6

[Hallvord R. M. Steen [:hallvors]]

(In reply to Jesse Ruderman from comment #4)
> I agree with Chris Palmer in thinking this is a bad idea:
> https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/3QL6mAhC3Lw/
> t02Uym1B66wJ

And I agree that supporting paste events for paste actions triggered from our trusted UI gets us almost all the power. Especially if we also have good support for beforepaste events so sites can tell the browser to enable its paste UI..

Web developers will likely keep pushing for the ability to create custom UI, and my inner power user wants a secret pref.. but I accept the wontfix for now ;)

Comment 7

[(no longer active)]

(In reply to Hallvord R. M. Steen [:hallvors] from comment #6)
> (In reply to Jesse Ruderman from comment #4)
> > I agree with Chris Palmer in thinking this is a bad idea:
> > https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/3QL6mAhC3Lw/
> > t02Uym1B66wJ
> 
> And I agree that supporting paste events for paste actions triggered from
> our trusted UI gets us almost all the power. Especially if we also have good
> support for beforepaste events so sites can tell the browser to enable its
> paste UI..

What constitutes good enough?  If you know of specific issues which prevent that, please do file them!

Comment 8

[Hallvord R. M. Steen [:hallvors]]

Can I convince you that at least bug 596764 - onbefore* events - should be fixed to be good enough? :)

Comment 9

[(no longer active)]

(In reply to Hallvord R. M. Steen [:hallvors] from comment #8)
> Can I convince you that at least bug 596764 - onbefore* events - should be
> fixed to be good enough? :)

Commented on the bug!