Closed Bug 1566585 Opened 3 years ago Closed 3 years ago

update to manifest with incognito.not_allowed does not remove permission

Categories

(WebExtensions :: General, defect, P1)

Product:
WebExtensions
Component:
General
Type:
defect

Tracking

(firefox70 fixed)

Status:
RESOLVED FIXED
Milestone:
mozilla70
Tracking Flags:
Tracking Status
firefox70 --- fixed

People

(Reporter: mixedpuppy, Assigned: mixedpuppy)

References

Details

Attachments

(1 file)

Bug 1566585 remove permission if extension updates to incognito.now_allowed
47 bytes, text/x-phabricator-request
Details | Review

If an extension is spanning and the user grants permission to private browsing, then the extension is updated to a version where the manifest declares not_allowed, we do not remove permission.

Assignee: nobody → mixedpuppy
Priority: -- → P1

Bugbug thinks this bug is a task, but please change it back in case of error.

Type: defect → task
Type: task → defect
Pushed by scaraveo@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ae5badd3b49e
remove permission if extension updates to incognito.now_allowed r=robwu,rpl

https://hg.mozilla.org/mozilla-central/rev/ae5badd3b49e

Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox70: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

Hello,

I've attempted to test this by installing on Firefox 70.0a1(20190829214656) an older version of the HTTP Everywhere extension (https://addons.mozilla.org/en-US/firefox/addon/https-everywhere/versions/), downloading and modifying the most recent version's manifest by setting incognito=not_allowed, and then updating the installed version through drag and drop of the modified newer version.
The extension permission from about:addons> HTTP Everywhere> Details showed that it was still allowed to "Run in Private Windows".
So far I am not sure what other method to use to test this.
If this fix requires manual validation please provide some steps to reproduce in order to correctly test it and also, please set the "qe-verify+" flag. Otherwise, could the "qe-verify-" flag be added? Thanks!

Flags: needinfo?(mixedpuppy)

Not sure what to say, but I just did a similar test with just a simple extension and the permission was removed as expected. This is also covered by automated tests, so given all that, I'll qe-

Flags: needinfo?(mixedpuppy) → qe-verify-
You need to log in before you can comment on or make changes to this bug.