106521 - javascript capabilities don't work (window.open, window.resizeto, etc...)

Status: CLOSED WORKSFORME

(Core :: Security, defect)

Description

[Jeff Wiegley]

In at least 0.9.5 this doesn't seem to work when placed in
~/.mozilla/user/?????/prefs.js...

user_pref("capability.policy.default.Window.innerWidth.set", "noAccess");
user_pref("capability.policy.default.Window.innerHeight.set", "noAccess");
user_pref("capability.policy.default.Window.outerWidth.set", "noAccess");
user_pref("capability.policy.default.Window.outerHeight.set", "noAccess");
user_pref("capability.policy.default.Window.sizeToContent", "noAccess");
user_pref("capability.policy.default.Window.resizeTo", "noAccess");
user_pref("capability.policy.default.Window.resizeBy", "noAccess");
user_pref("capability.policy.default.Window.screenX.set", "noAccess");
user_pref("capability.policy.default.Window.screenY.set", "noAccess");
user_pref("capability.policy.default.Window.moveTo", "noAccess");
user_pref("capability.policy.default.Window.moveBy", "noAccess");
user_pref("capability.policy.default.Screen.top", "noAccess");
user_pref("capability.policy.default.Screen.left", "noAccess");
user_pref("capability.policy.default.Screen.width", "noAccess");
user_pref("capability.policy.default.Screen.height", "noAccess");
user_pref("capability.policy.default.Screen.pixelDepth", "noAccess");
user_pref("capability.policy.default.Screen.colorDepth", "noAccess");
user_pref("capability.policy.default.Screen.availWidth", "noAccess");
user_pref("capability.policy.default.Screen.availHeight", "noAccess");
user_pref("capability.policy.default.Screen.availLeft", "noAccess");
user_pref("capability.policy.default.Screen.availTop", "noAccess");
user_pref("capability.policy.default.Window.status", "noAccess");
user_pref("capability.policy.default.Window.open", "noAccess");

For a simple test page try http://www.cvs.org/
As far as I'm concerned we MUST be able to prevent sites from
changing the configuration of my desktop. Why should a site be
allowed to interfere with my window placements and size?
Is it just simply that the resource names changed? If so to what?

But clearly:
http://www.mozilla.org/projects/security/components/configPolicy.html
is no longer valid and should be updated.

Comment 1

[Boris Zbarsky [:bzbarsky]]

worksforme with those prefs and on that site in current builds (ie, no resizing
happens).

Are you putting these in the right profile dir?  Do you have two profiles named
"something" and "something-1" by any chance?

Note that most of the prefs you listed should have UI in prefs within a week or
two -- the patch is currently being reviewed.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Worksforme as well, on recent Linux and NT4 builds. Reporter, please make sure
you're editing the correct profile, and that Mozilla is not running (and not
minimized in turbo/quickload mode) before you edit your prefs.js.

Bindu, can you verify this on the major platforms? Add the lines above to
prefs.js and then visit www.cvs.org - the browser window should not resize.

Comment 3

[bsharma]

Verified on 2001-10-31-Trunk build on WinNT

The browser window do not resize.
I am going to verify on Linux in a short while.

Comment 4

[Jeff Wiegley]

Ok. After destroying my hard-drive and a fresh install.
This now seems to work for me as well.

Maybe I did have the location of the prefs.js file incorrect or
something more subtle.  Possibly I edited the prefs.js file while
mozilla was running; quiting mozilla may have rewrote the current
prefs.js or something along these lines. But now it works for me on linux.
I'm marking this as "closed".