112006 - Confirmation dialog as a security level.

Status: RESOLVED DUPLICATE of bug 103405

(Core :: Security: CAPS, enhancement)

Description

[Andrew Sterling Hanenkamp]

According to the Configurable Security Policies page, there are three security
levels--noAccess, sameOrigin, and allAccess.  Actually, four if you consider
privileges as a fourth security level--as I've seen the nsSecurityManager.cpp
code does. I was digging around in the code because this is something that I'd
REALLY like to have.

That is, a security level that displays a dialog box to give the user permission
to do access a javascript property/method. Something like a confirmAccess
security level. If we wanted to be very fancy we could even create a whole new
level of configurability by allowing the user to actually specify a bit of
JavaScript code to run to determine if such access should be granted. Then, my
preference might look like:

function confirmAccess(url) {
    return confirm("Allow "+url+" to open a new popup?");
}

user_pref("capability.policy.default.Window.open", "confirmAccess");

In this way, new highly configurable privileges could be added. This is just a
cool idea from someone who has very little experience with Mozilla internals. I
don't know if this is a good one or not, but I didn't see it already listed in
the hoards of Bugzilla posts, so I thought I'd give it a shot.  At a minimum, I
would really like to see a confirmAccess security level.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Duplicate of 'Back End "Ask Me" preference to allow popups & other JavaScript'

*** This bug has been marked as a duplicate of 103405 ***