156734 - embed objects not shown in page info preview

Status: RESOLVED FIXED

(SeaMonkey :: Page Info, enhancement)

Description

[Jeremy M. Dolan]

http://www.cmp-lab.or.jp/technical/image/iformat/png/sample.html

source:

<embed SRC="ayaka.png" WIDTH=392 HEIGHT=327 ALT="ayaka.png (14k)"><br>

page info shows the other two images in <img> tags, but this one has no full
path, and just shows a broken image icon.

cvs moz linux.

Comment 1

[Daniel Brooks [:db48x]]

cursed relative paths

Comment 2

[Boris Zbarsky [:bzbarsky]]

http://lxr.mozilla.org/seamonkey/source/xpfe/browser/resources/content/pageInfo.js#808

looks like we've disabled <embed> and <object> preview in page info (something
about java, crashes, security holes, etc, iirc).  Bug 149777 has some of the
nifty details; in particular, the patch there (bug 149777, comment 14) does:

  4) When protocol is not allowed and/or element is OBJECT or EMBED, set
     the image to 'loading-image.gif' (a blank image would be better,
     but...).

So this is by-design....

Comment 3

[Mats Palmgren (inactive)]

*** Bug 156726 has been marked as a duplicate of this bug. ***

Comment 4

[Adam Hauner]

Same on Win.

Comment 5

[Adam Hauner]

BTW bug 153545 is IMHO related.

Comment 6

[Boris Zbarsky [:bzbarsky]]

It's not.  This bug arises because we no longer show preview for <embed>s in
page info due to security consideration.  Changing summary to reflect this.

Comment 7

[Greg K.]

Reproduced using FizzillaCFM/2002103011. Setting All/All.

I presume we could define a set of acceptable MIME types to preview and display
some sort of security warning for the rest.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #6)
> This bug arises because we no longer show preview for <embed>s in
> page info due to security consideration.  

Andrew, is this sufficient to close wontfix?

Comment 9

[Justin Kerk]

Even if security concerns mean we can't actually display the object, it would be nice to show something a little better than a broken-image icon....

Comment 10

[Philip Chee]

This is now a one line fix. We already allow HTMLObjectElement when isProtocolAllowed is true. I am going to do this in Bug 491310.

Comment 11

[Philip Chee]

Fixed by the patch in  Bug 491310 Comment 27