1327075 - "You have chosen to open" non-modal dialog - clicking "OK" button doesn't work for the first time if dialog isn't focused

Status: RESOLVED WONTFIX

(Firefox :: File Handling, defect)

Description

[arni2033]

>>>   My Info:   Win7_64, Nightly 49, 32bit, ID 20160526082509
I often download many files at once. Each file opens "You have chosen to open" non-modal dialog, so
in order to speed up the process (by avoiding numerous mouse movements), I click on each link to open
many "You have chosen to open" non-modal dialogs placed one above another, then I simply need to click
many times at the same place, where "OK" button is located. However, developers implemented a special
mechanism that only brings annoyances: in default install user can't click on OK button right after
focusing the dialog: he has to wait 3 seconds until "OK" button is enabled. Therefore Firefox devs
want every user to spend 0.5*N + 3*N seconds for downloading N files instead of 0.5*N + 0.1*N
(0.5s is approximate time required to click a download link, 0.1s is time spent for each click while
 clicking on the same place, 3s is extra time loss added by Firefox developers)
The purpose of this bug is to fix "OK" button behavior or remove the delay completely (see ER)


>>>
STR_1:
1. Open url [1]
2. Click on text "Link" on the page
3. Wait until "You have chosen to open" non-modal dialog appears. Wait until button "OK" is enabled
4. Click on the free place on the page, hover mouse over button "OK" inside the dialog
5. Click on button "OK"

AR:  The dialog is focused. "OK" button is disabled. No other actions


STR_2:
0. Open about:config, set pref "security.dialog_enable_delay" to 0 - it removes delay for "OK" button
1. Open url [1]
2. Click on text "Link" on the page
3. Wait until "You have chosen to open" non-modal dialog appears. Wait until button "OK" is enabled
4. Click on the free place on the page, hover mouse over button "OK" inside the dialog
5. Quickly click on button "OK"

AR:  The dialog is focused. "OK" button is enabled. No other actions

ER:  Either X or Y or Z or U or V.
 X) "OK" button should always be enabled in "You have chosen to open" dialog       (fixes STR_1,STR_2)
 Y) If dialog was opened more than K seconds ago, "OK" button should be enabled    (fixes STR_1,STR_2)
   (where K is value of pref "security.dialog_enable_delay")
 Z) If "OK" button was once enabled in that dialog,it should stay enabled forever (~fixes STR_1,STR_2)
 U) If "security.dialog_enable_delay" set to 0, "OK" button should always be enabled     (fixes STR_2)
 V) STR_2 should be fixed by some other underlying mechanism than assumed in (U), because (IMO) pref
   "security.dialog_enable_delay" exists for one purpose: to be able to click "OK" right away. (STR_2)
   
Notes:
1) I don't see any security threats other than user clicking around, and accidentally downloading a
   malicious file (I also remember the basic reasoning that says "if Firefox is compromised by some
   malicious process to the state when it can click on "OK" button in "You have chosen to open"
   dialog, then it's anyway compromised enough to the state when malicious process can simply download
   the file"). Therefore(*) there're no security threats in 2016 that aren't present on GoogleChrome
   which always immediately downloads the file. Thus, I thought it _may_ be sensible to completely
   delete delay from "You have chosen to open" non-modal dialog. Also, I think that pref
  "security.dialog_enable_delay" exists for those people who aren't afraid of clicking around and of
   other possible security threats.
(*) - reporter might not be aware of other security threats, and of how relevant is "basic reasoning"
2) Expectations from more general to more specific:   X > Y > Z > U > V
3) STR_2 Step 5 says "Quickly click" - that means that you should make minimal pause between mousedown
   and mouseup to be faster than the pref. Of course, not 0s, as defined by the pref. But the dialog
   spends some time (~0.1-0.2s) to become focused, therefore "OK" button stays disabled all that time.

> [1] data:text/html,<a onclick="setTimeout(function(){location.href='https://bugzilla.mozilla.org/attachment.cgi?id=8730849'},3000)">Link</a>

Comment 1

[:Gijs (he/him)]

This is a security delay and we won't remove it. If you're doing batch downloading, there are better tools for this. These days the dialog won't be there by default anyway.