180771 - Controllers and commanddispatchers are scary, same with focusedElement and focusedWindow, maybe something else

Status: RESOLVED FIXED

(Core :: XUL, defect, P3)

Description

[bsharma]

This bug is reported as the issue in the module review and jrgm asked me to make
a bug out of it.

 - make these accessible from chrome only.

Comment 1

[jag (Peter Annema)]

Shouldn't be hard to fix.

Comment 2

[Johnny Stenback (:jst)]

Do these need to be scriptable *on* non-chrome windows? If so, we'll need to
check that we're accessed from chrome in the getters for these (by calling
IsCallerChrome() in GlobalWindowImpl), if not, we can move these attributes into
nsIDOMChromeWindow.idl.

Comment 3

[Rafael Ebron (:rebron)]

navtriage:marking need info.  Mitch, can you comment on this bug for Buffy?

thx.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Jag, what's the security risk here?

Comment 5

[jag (Peter Annema)]

I think the focusedWindow and focusedElement attributes are the only ones that
might (need to test) give someone access to chrome from non-chrome. The rest
should be okay, and we probably want to provide them to XUL authors.

You can also access the commandDispatcher from nsIControllers, not sure if we
really need it on there.

Comment 6

[Samir Gehani]

adt: nsbeta1+/adt2

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Chris will try to get this for 1.4final, reassigning.

Comment 8

[Daniel Veditz [:dveditz]]

per comment 0 these are chrome only for sure now.