1755964 - Don't badger users to enable the xpinstall permission

Status: NEW

(Toolkit :: Add-ons Manager, enhancement, P3)

Description

[Daniel Veditz [:dveditz]]

If a site does not have install permission (the default) it is still allowed to start an install and then we prompt the user to give it permission. Like many such permission prompts this can be annoying (it's a popup, after all!) and used to abuse users into submitting.

This should behave like the permissions that are silently denied, but which users can easily enable from the "notification" icon in the URL bar that shows up in these cases. Examples of this behavior include blocked notification requests (global setting) or autoplay video.

Sites where users are legitimately interested in the install can instruct users how to do this simple action. Drive-by "low-context" attempts just hoping users will be confused and click "OK" will not.

Comment 1

[Daniel Veditz [:dveditz]]

This change would likely require revamping the meaning of the "Warn you when sites try to install add-ons" checkbox.

First, we need to make the xpinstall.whitelist.required pref about:config only, or kill it entirely (keeping default "true" behavior).

Second, have to decide whether to keep the checkbox or not.

• If kept it would control the "don't prompt" behavior above. Might not even need to change the words, just make the default "off". Or change "Warn" to "Ask" or something.
• Or change the presentation to more like the "Permissions" above: a label but no checkbox, with a "Settings..." button instead of an "Exceptions..." button.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mixedpuppy, could you have a look please?

For more information, please visit auto_nag documentation.