102289 - Certain documentation for Security has browser UI specific information

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P2)

Description

[Radha on family leave (not reading bugmail)]

Certain documentation (probably dialog messages) has references to
mozilla/netscape browser UI. This  does not work well in embedded applications
that have their own UI.

Following are 2 segments of code that has mozilla UI specific info.

\mozilla\security\manager\ssl\resources\locale\en-US\pipnss.properties(150):SSLDisabled=

"You cannot connect to %S because SSL is disabled. To change this setting,
<XXX BEGIN CHANGE>
 choose Preferences from the Edit menu, click Privacy and Security, and click
the subcategory SSL." <XXX END CHANGE>

\mozilla\security\manager\ssl\resources\locale\en-US\pipnss.properties(151):SSL2Disabled=

"You cannot connect to %S because SSL version 2 is disabled.  To change this
setting, 
<XXX BEGIN CHANGE>
c hoose Preferences from the Edit menu, click Privacy and Security, and click
the subcategory SSL." <XXX END CHANGE>

Comment 1

[Judson Valeski]

-> javi.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

I'm assuming Jud meant to reassign this bug.

Comment 3

[Stephane Saux]

Giving user input on what he or she needs to do to correct a problem, including
helping in navigating the UI is a must.  What is the accepted way of doing this?

Comment 4

[Judson Valeski]

cc'ing german. I'm not sure what the right thing is. I'd actually argue though
that "documentation" (user manuals, online help) is the immediate answer though.
Mozilla no longer controls the UI that uses the underlying modules, and
propegating "instructions" at this level isn't right.

Comment 5

[Radha on family leave (not reading bugmail)]

I think the part that describes the UI can be put in a separate property and
referenced independantly in the js or xul file. Then the embedding application
can replace the mozilla UI property string with its own UI description or omit
it, if it doesn't  want reference to the UI.

Comment 6

[Radha on family leave (not reading bugmail)]

Attachment: Initial patch

Comment 7

[Radha on family leave (not reading bugmail)]

I have attached a patch which segregates the UI information from the original
property string. This enables a embeddor to either ignore the UI info or replace
it with their UI info. I think simply not defining SSLDisabledUI in the property
file will render the message without the UI info. I hope this will be a
reasonable solution to the embeddors.

This patch builds in Windows. (I haven't tried linux yet.) I don't know how to
test this. I don't even know when and where this message will show up. Can some
one in the security team try out the patch and make sure that mozilla works jsut
as it should be. 

Comment 8

[Judson Valeski]

This seems like a reasonable workaround, but I still don't think we should be
displaying instructions in dialogs. I suggest we pull the instructions text
altogether, and just put instructions in our documentation.

Comment 9

[Radha on family leave (not reading bugmail)]

Attachment: Updated patch

Comment 10

[Radha on family leave (not reading bugmail)]

I have attached a patch that just removes the UI references  from dialog
messages. I understand that the UE  group is fine with this kind of changes. For
more discussion on the see bug 102288.

Comment 11

[Radha on family leave (not reading bugmail)]

Taking from jave, as I have the patch and trying to get it in ASAP.

Comment 12

[Alec Flett]

that's not a patch, its a "cvs status" :)

Comment 13

[Radha on family leave (not reading bugmail)]

Attachment: the right patch

Comment 14

[Judson Valeski]

cc'ing security folks. r=valeski on the mods, but we need to have they'r buyin'
before checking this in.

Comment 15

[Alec Flett]

sr=alecf for once you have their acceptance.

Comment 16

[Stephane Saux]

Comment on attachment 52584 [details] [diff] [review]
the right patch

reviewed.  This must be checked in by somebody with the proper access to the security area. Radha, you don't have access, so somebody in PSM will need to do it.

Comment 17

[Kai Engert [:KaiE:]]

Checked in to trunk, marking resolved.

Comment 18

[Judson Valeski]

adding dependency for tracking purposes.

Comment 19

[John Unruh]

Verified on 10/12 Win98 trunk.

Comment 20

[Judson Valeski]

minusing. not needed on the branch.