1412561 - Add-on installation should be blocked when in full-screen mode

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, enhancement, P2)

Description

[Andreas Jung]

The page mentioned in bug 1412559 (if it sometimes decides not to make the browser instantly unusable / locked up) switches the browser into fullscreen mode and then pops up the add-on installation doorhanger notification.[1]

Allowing the add-on installation doorhanger notification to appear in fullscreen mode is bad for two reasons:
- It is possibly easier for a malicious website to try to trick the user by showing fake browser or operating system UI
- It is much more intimidating so the user is more likely to allow the installation.

I think an attempt to install add-ons should (silently?) fail when in fullscreen mode. I can't see any reason why a legitimate website would require to initiate add-on installation in full-screen mode.

(The .xpi the page attempts to install should probably be blacklisted if this isn't the case already. I have no idea how / where to report this.)

[1] This is probably the wrong name: It's not asking "Do you want to install the following add-on" but the "Firefox prevented the site from asking you to install an add-on" message, but that's not much better as it's just one more click.

Comment 1

[Andy McKay]

Agreed, I think we should prevent installation because it's no longer clear this isn't content creating those popups.

Could you please file a bug in Bugzilla under Toolkit > Blocklisting outlining why you think the add-on should be blocked.

Comment 2

[Andreas Jung]

(In reply to Andy McKay [:andym] from comment #1)
> Agreed, I think we should prevent installation because it's no longer clear
> this isn't content creating those popups.
> 
> Could you please file a bug in Bugzilla under Toolkit > Blocklisting
> outlining why you think the add-on should be blocked.

Filed Bug 1413665.

Comment 4

[Emma Zühlcke [:emz]]

Attachment: Bug 1412561 - Block addon installation prompts in fullscreen mode. r=johannh

Comment 5

[Johann Hofmann [:johannh]]

We should send out a short notice about this to dev-addons once the current storm has calmed.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2268e6a9359e
Block addon installation prompts in fullscreen mode. r=johannh,aswan

Comment 7

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/2268e6a9359e