Warn users when unsigned add-ons have been disabled during startup

VERIFIED FIXED in Firefox 40

Status

()

Toolkit
Add-ons Manager
P1
normal
VERIFIED FIXED
3 years ago
2 years ago

People

(Reporter: mossop, Assigned: dao)

Tracking

Trunk
mozilla40
Points:
5
Dependency tree / graph
Bug Flags:
firefox-backlog +
qe-verify +

Firefox Tracking Flags

(firefox40 verified, firefox41 verified)

Details

(Whiteboard: [fxsearch][searchhijacking])

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
This is very similar to bug 1038071, in fact I think we should use the same UI for both, but in some cases we will disable add-ons during startup because they aren't signed. This will happen particularly on the first upgrade to a version that enforces add-on signing.

The patch from bug 1038068 allows us to detect add-ons disabled during startup using AddonManager.getStartupChanges(AddonManager.STARTUP_CHANGE_DISABLED), we can then filter the list of ids returned for add-ons that are unsigned.
(Reporter)

Updated

3 years ago
Points: --- → 5
Flags: qe-verify+
Flags: firefox-backlog+
(Reporter)

Updated

3 years ago
Whiteboard: [fxsearch][searchhijacking]
(Reporter)

Updated

3 years ago
Priority: -- → P1
(Assignee)

Comment 1

3 years ago
(In reply to Dave Townsend [:mossop] from comment #0)
> This is very similar to bug 1038071, in fact I think we should use the same
> UI for both,

Just to be clear, that's attachment 8598783 [details], right?
(Assignee)

Updated

3 years ago
Assignee: nobody → dao
Status: NEW → ASSIGNED
Iteration: --- → 40.3 - 11 May
(Reporter)

Comment 2

3 years ago
(In reply to Dão Gottwald [:dao] from comment #1)
> (In reply to Dave Townsend [:mossop] from comment #0)
> > This is very similar to bug 1038071, in fact I think we should use the same
> > UI for both,
> 
> Just to be clear, that's attachment 8598783 [details], right?

Yes that's right
(Assignee)

Updated

3 years ago
Depends on: 1151509
(Assignee)

Comment 3

3 years ago
Created attachment 8602779 [details] [diff] [review]
patch
(Assignee)

Updated

3 years ago
Attachment #8602779 - Flags: review?(dtownsend)
(Reporter)

Updated

3 years ago
Attachment #8602779 - Flags: review?(dtownsend) → review+

Comment 4

3 years ago
https://hg.mozilla.org/integration/fx-team/rev/dbec5281f625
https://hg.mozilla.org/mozilla-central/rev/dbec5281f625
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox40: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
QA Contact: vasilica.mihasca
I have tested this bug based on https://bug1148403.bugzilla.mozilla.org/attachment.cgi?id=8598783 and here is what I have noticed:
   1. The yellow warning bar is not displayed after the browser is restarted
   2. The yellow triangle from “Some extensions could not be verified” button misses: http://i.imgur.com/m4uIX9i.jpg
   3. It is not specified, in the explanation text, where you can find signed add-ons. The addons.mozilla.org site is opened when you click on “find replacements” link: http://i.imgur.com/TnzlONI.jpg


I tested applying 2 methods and the results were the same in both cases.
   1. Following the steps mentioned in https://bugzilla.mozilla.org/show_bug.cgi?id=1148403#c47
   2. Creating a profile using a release version of Firefox (e.g Firefox 38.0.5) -> Creating xpinstall.signatures.required=true in about:config -> Adding an unsigned add-on -> Closing Firefox -> Opening Nightly/Aurora using the same profile  

Tested using Firefox 40.0a2 (2015-06-08) and Firefox 41.0a1 (2015-06-08) under Windows 7 64-bit and Ubuntu 14.04 32-bit.

Based on the above mentions should I reopen this bug or file separate ones?
Flags: needinfo?(dtownsend)
(Reporter)

Comment 7

3 years ago
Probably better for tracking purposes to file a new bug at this point
Flags: needinfo?(dtownsend)
(Reporter)

Updated

3 years ago
Depends on: 1172708
(Reporter)

Updated

3 years ago
Depends on: 1172710
(Reporter)

Comment 8

3 years ago
(In reply to Vasilica Mihasca, QA [:vasilica_mihasca] from comment #6)
> I have tested this bug based on
> https://bug1148403.bugzilla.mozilla.org/attachment.cgi?id=8598783 and here
> is what I have noticed:
>    1. The yellow warning bar is not displayed after the browser is restarted
>    2. The yellow triangle from “Some extensions could not be verified”
> button misses: http://i.imgur.com/m4uIX9i.jpg

Minor UI issue, let's just get a bug on file for it but it's not a high priority.

>    3. It is not specified, in the explanation text, where you can find
> signed add-ons. The addons.mozilla.org site is opened when you click on
> “find replacements” link: http://i.imgur.com/TnzlONI.jpg

I'm not sure I understand this. You say the link does go to addons.mozilla.org and that sounds correct to me. What else are you expecting here?

> I tested applying 2 methods and the results were the same in both cases.
>    1. Following the steps mentioned in
> https://bugzilla.mozilla.org/show_bug.cgi?id=1148403#c47
>    2. Creating a profile using a release version of Firefox (e.g Firefox
> 38.0.5) -> Creating xpinstall.signatures.required=true in about:config ->
> Adding an unsigned add-on -> Closing Firefox -> Opening Nightly/Aurora using
> the same profile

These two cases produce different behaviours for me so I filed bug 1172708 and bug 1172710
Depends on: 1172835
(In reply to Dave Townsend [:mossop] from comment #8)

> Minor UI issue, let's just get a bug on file for it but it's not a high
> priority.
  
 I filed Bug 1172835

> >    3. It is not specified, in the explanation text, where you can find
> > signed add-ons. The addons.mozilla.org site is opened when you click on
> > “find replacements” link: http://i.imgur.com/TnzlONI.jpg
> 
> I'm not sure I understand this. You say the link does go to
> addons.mozilla.org and that sounds correct to me. What else are you
> expecting here?

 Based on mockup the explanation text should be: The following add-ons have not been verified for use in Firefox. You can find replacements at addons.mozilla.org or ask the add-on developer to get them verified. 
Actually it is: The following add-ons have not been verified for use in Firefox. You can find replacements or ask the developer to get them verified. 

Do you see the difference? I vote for the mockup version because it is clearly specified which site is the official one.   In the current version, when you click on find replacements link, you do not know what site will be opened.  

What do you think?
Flags: needinfo?(dtownsend)
(Reporter)

Comment 10

3 years ago
Ah yeah I see the difference. I filed bug 1173079.
Flags: needinfo?(dtownsend)
Based on my previous testing from Comment 6 and on my recent testing on Mac OS X 10.9.5 using Firefox 40.0a2 (2015-06-10) and Firefox 41.0a1 (2015-06-10), I am marking this bug as Verified since the other issues are tracked separately.
Status: RESOLVED → VERIFIED
status-firefox40: fixed → verified
status-firefox41: --- → verified
(Reporter)

Updated

2 years ago
Depends on: 1191008
Depends on: 1196083
You need to log in before you can comment on or make changes to this bug.