1207746 - Enable Protection doesn't work if user globally turns off Mixed Content Blocking

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect, P3)

Description

[Tanvi Vyas[:tanvi]]

Steps to reproduce:
* Go to about:config and turn security.mixed_content.block_active_content to false
* Go to https://people.mozilla.com/~tvyas/mixedcontent.html and you will see the crossed out lock since protection has been globally disabled and mixed active content loads.
* Click on the control center; click to the security subpanel.  You see the enable protection button.
* Click enable protection.  The page reloads with protection still disabled.

Here are a couple options to fix this broken UX:
1) Should enable protection work on a site when the mixed content pref is disabled globally?  I'm inclined to think not; the page has already loaded once with mixed active content.  But I can see a case where a user enables protection before entering sensitive information in a form and submitting it.  The submit may or may not succeed, but that is another story.

2) Should we remove the enable protection button in this scenario, since it doesn't work.

This is a low priority bug, because the number of users who disable the pref globally is probably very slim (we just started collecting this with bug https://bugzilla.mozilla.org/show_bug.cgi?id=1150602).  But I wanted to catalog it here anyway.

Comment 1

[Tim Taubert [:ttaubert] (inactive)]

(In reply to Tanvi Vyas out until 9/28 [:tanvi] from comment #0)
> 2) Should we remove the enable protection button in this scenario, since it
> doesn't work.

I'd probably go for that, or maybe disable the button assuming users flipping that pref know they did that?

Comment 2

[Frederik Braun [:freddy]]

I think this one can be closed out. We do not intend to support "active mixed content blocking" when disabled.