1719908 - All events and functions of the compose API, which give access to message content or allow to alter the message, should require the compose permission

Status: RESOLVED FIXED

(Thunderbird :: Add-Ons: Extensions API, defect)

Description

[John Bieling]

The following functions/events can be used without any permission:

• onAttachmentAdded
• listAttachments
• addAttachment
• updateAttachment
• removeAttachment

They should require the compose permission, like get/setComposeDetails.

Comment 1

[John Bieling]

Attachment: Bug 1719908 - Require compose permission for all events/function, which access or alter the message content. r=mkmelin.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/c5af306d06f4
Require compose permission for all events/function, which access or alter the message content. r=mkmelin.

Comment 3

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1719908 follow-up - Fix error message check for beta. r=john.bieling

A different error message is used depending on the channel: https://hg.mozilla.org/mozilla-central/rev/03939cd2d0ab#l5.1

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/8de3c662979f
follow-up - Fix error message check for beta. r=john.bieling

Comment 5

[John Bieling]

Comment on attachment 9230881 [details]
Bug 1719908 follow-up - Fix error message check for beta. r=john.bieling

[Approval Request Comment]
Regression caused by (bug #):
User impact if declined:
Some tests fail.

Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky):
None.

Comment 6

[Wayne Mery (:wsmwk)]

Comment on attachment 9230881 [details]
Bug 1719908 follow-up - Fix error message check for beta. r=john.bieling

[Triage Comment]
Approved for beta

Comment 7

[Rob Lemley [:rjl]]

Thunderbird 91.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/7361832250b9