Closed Bug 1560150 Opened 7 years ago Closed 7 years ago

Firefox 67: Default Action for Open Link Button in Open with Application no longer a Press of the Enter Key

Categories

(Firefox :: File Handling, defect)

67 Branch
defect
Not set
normal

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox-esr60 --- unaffected
firefox67 --- wontfix
firefox67.0.1 --- wontfix
firefox68 --- affected
firefox69 --- affected

People

(Reporter: elliottabarnes, Unassigned)

References

(Regression)

Details

(Keywords: regression, reproducible)

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

When opening a link that a user hasn't explicitly set a default preference for (a "mailto:" being an example), Firefox asks what the user would like to do, and offers multiple choices. In pre-67 builds, when this window appeared a user could simply hit the enter key on the keyboard to accept the default choice - however, this is no longer the case and for users of assistive technology, the button must manually be focused on - and although this action isn't time consuming, is slightly less convenient.

Would it be possible to restore pre-67 behaviour, so that the button to open the link can once again be activated with a quick press of the enter key?

Actual results:

When pressing the enter key from this screen, the "Open Link" button is no longer automatically activated.

Expected results:

As with pre-67 builds of the browser, the enter key should have opened the link with the user's choice.

Keywords: regression
Component: Untriaged → File Handling
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: reproducible

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f798f327a76198fc38ae07358768e556fe126039&tochange=6fefc560ddc453a3a41dc1048a917f0cc0d69655

Regressed by:
6fefc560ddc453a3a41dc1048a917f0cc0d69655 Gijs Kruitbosch — Bug 1552627 - pt 2, r=dveditz
29d9eb1276a71d4f4f1edefe4b0e720e4b16f952 Gijs Kruitbosch — Bug 1552627 - r=dveditz

Gijs, Your bunch of patch seems to cause the regression. Can you please look into this?

Flags: needinfo?(gijskruitbosch+bugs)
Regressed by: CVE-2019-11702

This was an intentional change in response to a security issue - not specific to mailto, but for all external protocol handlers (which won't all be as safe/trustworthy as your email program).

You can set Firefox to remember your choice ("always do this for mailto: links"), after which you wouldn't see this dialog again.

Unfortunately, given the security issue, we won't be changing this. In theory, I guess we could do something different for mailto: links than we do for others, but that seems counterintuitive and unlikely to really make people happy, either.

Note that I'm a bit surprised you're seeing this dialog at all for mailto: . I believe the default configuration is to use the system default mailto handler, which on Windows is likely going to mean Win10 "Mail" or (on earlier versions) Outlook Express. Is there something specific about your configuration that has caused us to show this dialog (ie has you or an admin configured Firefox differently) ?

Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(gijskruitbosch+bugs) → needinfo?(elliottabarnes)
Resolution: --- → WONTFIX

I'm all for security, and after reviewing the reason for this this makes total sense and I'm more than happy for this change to remain as it is. Just out of interest - why was this done? My assumption would be to accidentally stop users from simply hitting enter as soon as they see the dialog.

In my case, the above protocol was just an example - I was trying to think of a real-life example that I could use!

Thanks.

Flags: needinfo?(elliottabarnes)

(In reply to elliottabarnes from comment #3)

I'm all for security, and after reviewing the reason for this this makes total sense and I'm more than happy for this change to remain as it is. Just out of interest - why was this done? My assumption would be to accidentally stop users from simply hitting enter as soon as they see the dialog.

Yep, though we added some other protections as well. My understanding is other browsers also don't focus the "unsafe" option by default.

In my case, the above protocol was just an example - I was trying to think of a real-life example that I could use!

Ah, OK, that makes sense.

Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.