Closed
Bug 1535444
Opened 7 years ago
Closed 7 years ago
MozTogglePictureInPicture shouldn't be accepted from untrusted sources
Categories
(Toolkit :: Video/Audio Controls, enhancement)
Toolkit
Video/Audio Controls
Tracking
()
VERIFIED
FIXED
mozilla67
| Tracking | Status | |
|---|---|---|
| firefox-esr60 | --- | unaffected |
| firefox65 | --- | unaffected |
| firefox66 | --- | unaffected |
| firefox67 | --- | verified |
People
(Reporter: mconley, Assigned: mconley)
Details
Attachments
(1 file)
Honestly, I'm not sure why this was set, but we definitely don't want websites to just be able to fire this event and cause Picture-in-Picture to happen.
In an overabundance of caution, I'm marking as a security bug - the handler is Nightly-only for now, and I think it's pretty benign, but why not be careful.
|
Assignee | |
Comment 1•7 years ago
|
||
|
|
Assignee | |
Updated•7 years ago
|
status-firefox65:
--- → unaffected
status-firefox66:
--- → unaffected
status-firefox-esr60:
--- → unaffected
|
||
Comment 2•7 years ago
|
||
https://hg.mozilla.org/integration/autoland/rev/afb5f4cea79143c6395c6a6e28faf9affdd43f33
https://hg.mozilla.org/mozilla-central/rev/afb5f4cea791
Group: firefox-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox67:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
|
||
Updated•7 years ago
|
Assignee: nobody → mconley
|
|
||
Comment 3•7 years ago
|
||
Verified as fixed on the latest Beta version based on the fact that an automated test was implemented specifically for this issue. For more information please see bug 1535454
Status: RESOLVED → VERIFIED
|
||
Updated•6 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•