Closed Bug 1566585 Opened 4 years ago Closed 4 years ago

update to manifest with incognito.not_allowed does not remove permission


(WebExtensions :: General, defect, P1)



(firefox70 fixed)

Tracking Status
firefox70 --- fixed


(Reporter: mixedpuppy, Assigned: mixedpuppy)




(1 file)

If an extension is spanning and the user grants permission to private browsing, then the extension is updated to a version where the manifest declares not_allowed, we do not remove permission.

Assignee: nobody → mixedpuppy
Priority: -- → P1

Bugbug thinks this bug is a task, but please change it back in case of error.

Type: defect → task
Type: task → defect
Pushed by
remove permission if extension updates to incognito.now_allowed r=robwu,rpl
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70


I've attempted to test this by installing on Firefox 70.0a1(20190829214656) an older version of the HTTP Everywhere extension (, downloading and modifying the most recent version's manifest by setting incognito=not_allowed, and then updating the installed version through drag and drop of the modified newer version.
The extension permission from about:addons> HTTP Everywhere> Details showed that it was still allowed to "Run in Private Windows".
So far I am not sure what other method to use to test this.
If this fix requires manual validation please provide some steps to reproduce in order to correctly test it and also, please set the "qe-verify+" flag. Otherwise, could the "qe-verify-" flag be added? Thanks!

Flags: needinfo?(mixedpuppy)

Not sure what to say, but I just did a similar test with just a simple extension and the permission was removed as expected. This is also covered by automated tests, so given all that, I'll qe-

Flags: needinfo?(mixedpuppy) → qe-verify-
You need to log in before you can comment on or make changes to this bug.