1625793 - messages.query by folder shouldn't be allowed without accountsRead permission

Status: RESOLVED FIXED

(Thunderbird :: Add-Ons: Extensions API, defect)

Description

[Geoff Lankow (:darktrojan)]

The extension shouldn't be able to get a folder object to pass to messages.query without the permission anyway, but it still should be blocked.

Comment 1

[Geoff Lankow (:darktrojan)]

Attachment: 1625793-require-accountsread-1.diff

Not in a rush to send this to 68, but it probably should go there.

Comment 2

[Magnus Melin [:mkmelin]]

Comment on attachment 9137049 [details] [diff] [review]
1625793-require-accountsread-1.diff

Review of attachment 9137049 [details] [diff] [review]:
-----------------------------------------------------------------

r=mkmelin

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/f91579666b7a
Require accountsRead permission for functions involving folders. r=mkmelin

Comment 4

[Wayne Mery (:wsmwk)]

Comment on attachment 9137049 [details] [diff] [review]
1625793-require-accountsread-1.diff

Approved for ESR

Comment 5

[Magnus Melin [:mkmelin]]

Thunderbird 68.7: https://hg.mozilla.org/releases/comm-esr68/rev/92605af82ba82d1868ffbc76c33cc41731cbbc4a