155038 - Cookies aren't sent from sidebar when "enable cookies for the originating site only" is set

Status: VERIFIED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[Bradley Baetz (:bbaetz)]

Bugzilla now comes with a sidebar. However, cookies aren't being sent to the
website, so the result sidebar is as if you wren't logged in.

To reproduce:

1) Make sure you're logged into bugzilla
2) Have the cookie pref set to originating site only
3) click the js link in the URL field to install the sidebar.

Results:

1) Unlogged in data is shown

Expected:

1) Logged in data, including any saved queries, and so on is shown

This occurs with 1.0 and CVS from a couple of days ago. Loading sidebar.cgi
directly into the browser window produces the expected results.

The reason for this is that cookies aren't being sent for loads from the
browser. Using printf, it turns out that the cookie module is given a chrome url
as the source uri for the load from the sidebar, and the chrome url is
considered to be foreign to the http one.

I don't know if we should fix cookies to consider chrome urls to be special, or
if the sidebar needs to do something.

Comment 1

[Stephen P. Morse]

Attachment: never consider chrome URLs to be foreign

Comment 2

[Alec Flett]

Comment on attachment 90592 [details] [diff] [review]
never consider chrome URLs to be foreign

sr=alecf

Comment 3

[Bradley Baetz (:bbaetz)]

Comment on attachment 90592 [details] [diff] [review]
never consider chrome URLs to be foreign

r=bbaetz. Why doesn't this code use nsIURI, btw?

Comment 4

[Stephen P. Morse]

Probably because it's legacy code.

Comment 5

[Stephen P. Morse]

Fixed on trunk

Comment 6

[Tom Everingham]

verified trunk - 07/12/02 builds - winNT4, linux rh6, mac osX

needs tested on branch

Comment 7

[Stephen P. Morse]

Actually I wasn't considering nominating this for branch checkin.  But since 
it's such a safe patch, maybe I will.

Comment 8

[Jaime Rodriguez, Jr.]

adt1.0.1+ (on ADT's behalf) approval for checkin to the 1.0 branch, pending
Drivers' approval. pls check this in asap, the replace "mozilla1.0.1+" with
"fixed1.0.1". thanks!

Comment 9

[chris hofmann]

Comment on attachment 90592 [details] [diff] [review]
never consider chrome URLs to be foreign

a=chofmann for 1.0.1