1967708 - Private tabs thumbnails are visible when opening a bookmark/history/search group item in a private tab

Status: VERIFIED FIXED

(Firefox for Android :: Privacy, defect)

Description

[Vasilica Tamas (Android QA) [:vtamas]]

Attachment: OpenBookmarkInPrivateTab.mp4

Lock tabs

Steps to reproduce

1. Open at least one private tab.
2. Switch to non-private mode.
3. Minimize and restore the app.
4. a) Go to Settings -> Bookmarks, tap o 3 dots menu displayed on the right side of a bookmarks and select "Open in private tab";
   b) Go to Settings -> History, select multiple items, tap on the 3 dot menu and select "Open in private tab";
   c) Go to Homepage -> Recently visited, tap on a search group, select an item, tap on the 3 dot menu and select "Open in private tab".

Expected behavior

The biometric authentication is requested before displaying the tabs thumbnails in private tabs tray.

Actual behavior

The new opened tab is displayed in the private tabs tray, also revealing the other private tabs thumbnails already opened. The authentication is requested only when selecting a private tab from tabs tray.

Device information

• Firefox version: Firefox for Android Nightly 140 (2025-05-20)
• Android device model: Samsung S24 Ultra (Android 14), Google Pixel 8 (Android 15)

Comment 1

[Mike a [:mavduevskiy]]

Attachment: Bug 1967708 - Part 1: Make PBM lock verification logic reusable and available outside of tabstray

We need to use exactly the same logic on history and bookmarks fragments before opening tabstray, refactoring to avoid code duplication.

Comment 2

[Mike a [:mavduevskiy]]

Attachment: Bug 1967708 - Part 2: Require auth for private tabs on history screen

Comment 3

[Mike a [:mavduevskiy]]

Bookmarks part requires more time, there is more architecture there; probably, have to add a new action, something like "onVerified", to wire up MiddleWare and a Fragment. Otherwise, if the vefification goes through a pin, there is no way to continue same midleware action chain.

Comment 4

[Mike a [:mavduevskiy]]

Attachment: Bug 1967708 - Part 3: Require auth for private tabs on bookmarks screen

This is a concept to get feedback from people who worked on the recent bookmarks refactoring.

Comment 5

[Mike a [:mavduevskiy]]

synced with :matt-tighe today about it, discussing ways to improve it. opened up a followup for it

Comment 6

[Mike a [:mavduevskiy]]

based on feedback for D252266, exploring an option to reuse UnlockPrivateTabsFragment in a headless state, to be used by History/Bookmarks fragment and listening to appstate for result.

Comment 7

[:Gela]

This ticket may possibly also address "If user switches to PBM from the tabs tray and minimizes the app and reopens it, the app should be locked and require authenticating" so we should test that when this is done

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/21e5826341c3
https://hg.mozilla.org/integration/autoland/rev/e99a039a6853
Part 1: Make PBM lock verification logic reusable and available outside of tabstray r=android-reviewers,twhite,gmalekpour
https://github.com/mozilla-firefox/firefox/commit/baeffff90ff9
https://hg.mozilla.org/integration/autoland/rev/184e3b83f557
Part 2: Require auth for private tabs on history screen r=android-reviewers,twhite,gmalekpour
https://github.com/mozilla-firefox/firefox/commit/aea917d972d0
https://hg.mozilla.org/integration/autoland/rev/1ff38bc5a9fb
Part 3: Require auth for private tabs on bookmarks screen r=android-reviewers,gmalekpour,matt-tighe

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/437ac6d21915
https://hg.mozilla.org/integration/autoland/rev/dcea5a30dd46
Revert "Bug 1967708 - Part 3: Require auth for private tabs on bookmarks screen r=android-reviewers,gmalekpour,matt-tighe" for causing Fenix failures.

Comment 10

[Atila Butkovits]

Backed out for causing Fenix failures.

Backout link: https://hg-edge.mozilla.org/integration/autoland/rev/dcea5a30dd46304a57edeae85daf6210fbf3da01

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&searchStr=fenix%2Copt%2Cfenix%2Cbuilds%2Cmade%2Cfor%2Ctesting%2Ctest-apk-fenix-debug%2Ct&revision=1ff38bc5a9fb5c4d0ae3567dff0a51b7d6fe60c7

Failure log: https://treeherder.mozilla.org/logviewer?job_id=511975561&repo=autoland&lineNumber=32120

Comment 11

[Mike a [:mavduevskiy]]

That's a suspicious failure, the code area isn't related and wasn't modified, the same job did pass mach try and it passes locally. Rebasing and trying again.

Comment 12

[Mike a [:mavduevskiy]]

found the issue, a test missing a 'isPrivateScreenLocked' mock. relaunching tests to check that it's gone and landing it

interesting detail, the test would only fail if all tests were launched. the test individually, as a class and even as a suite did work correctly. but after adding a, seemingly unrelated, mock, but now './gradlew :app:testDebugUnitTest' passes locally.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/17926335c037
https://hg.mozilla.org/integration/autoland/rev/a1e3aa558021
Part 1: Make PBM lock verification logic reusable and available outside of tabstray r=android-reviewers,twhite,gmalekpour
https://github.com/mozilla-firefox/firefox/commit/d1313798e771
https://hg.mozilla.org/integration/autoland/rev/23c2188ecc87
Part 2: Require auth for private tabs on history screen r=android-reviewers,twhite,gmalekpour
https://github.com/mozilla-firefox/firefox/commit/cc26c90dcb9a
https://hg.mozilla.org/integration/autoland/rev/46aed06c9fdd
Part 3: Require auth for private tabs on bookmarks screen r=android-reviewers,gmalekpour,matt-tighe

Comment 14

[:Gela]

Attachment: Bug 1967708 - Part 1: Make PBM lock verification logic reusable and available outside of tabstray

We need to use exactly the same logic on history and bookmarks fragments before opening tabstray, refactoring to avoid code duplication.

Original Revision: https://phabricator.services.mozilla.com/D251978

Comment 15

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Private tabs thumbnails would be visible when opening a bookmark/history/search group item in a private tab even though user has locked private tabs.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Listed in ticket 1967708
• Risk associated with taking this patch: Low
• Explanation of risk level: In this patch we are only refactoring existing logic that is specific to private browsing
• String changes made/needed: N/A
• Is Android affected?: yes

Comment 16

[:Gela]

Attachment: Bug 1967708 - Part 1: Make PBM lock verification logic reusable and available outside of tabstray

We need to use exactly the same logic on history and bookmarks fragments before opening tabstray, refactoring to avoid code duplication.

Original Revision: https://phabricator.services.mozilla.com/D251978

Comment 17

[:Gela]

Attachment: Bug 1967708 - Part 2: Require auth for private tabs on history screen

Original Revision: https://phabricator.services.mozilla.com/D252025

Comment 18

[:Gela]

Attachment: Bug 1967708 - Part 3: Require auth for private tabs on bookmarks screen

Original Revision: https://phabricator.services.mozilla.com/D252266

Comment 19

[:Gela]

Attachment: Bug 1967708 - Part 1: Make PBM lock verification logic reusable and available outside of tabstray

We need to use exactly the same logic on history and bookmarks fragments before opening tabstray, refactoring to avoid code duplication.

Original Revision: https://phabricator.services.mozilla.com/D251978

Comment 20

[:Gela]

Attachment: Bug 1967708 - Part 2: Require auth for private tabs on history screen

Original Revision: https://phabricator.services.mozilla.com/D252025

Comment 21

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Private tabs thumbnails would be visible when opening a bookmark/history/search group item in a private tab even though user has locked private tabs.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Listed in ticket 1967708
• Risk associated with taking this patch: Low
• Explanation of risk level: This doesn't change the existing behavior for history fragment unless user has enabled locking private tabs. If that's the case then user needs to authenticate first before viewing private tabs from the history fragment
• String changes made/needed: n/a
• Is Android affected?: yes

Comment 22

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Private tabs thumbnails would be visible when opening a bookmark/history/search group item in a private tab even though user has locked private tabs.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Listed in ticket 1967708
• Risk associated with taking this patch: Moderate
• Explanation of risk level: We now require authentication to access bookmarks and open them in private tabs if user has enabled locking private tabs. This is moderate in risk because it's changing code in bookmarks but we have included tests to ensure everything works as intended and looped in engineers from the squad that works on bookmarks to ensure the changes do not introduce any regressions.
• String changes made/needed: n/a
• Is Android affected?: yes

Comment 23

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/a1e3aa558021
https://hg.mozilla.org/mozilla-central/rev/23c2188ecc87
https://hg.mozilla.org/mozilla-central/rev/46aed06c9fdd

Comment 24

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/5f9f107c0422
https://hg.mozilla.org/releases/mozilla-beta/rev/4bc45caaa195
https://github.com/mozilla-firefox/firefox/commit/389dc9cb5bf4
https://hg.mozilla.org/releases/mozilla-beta/rev/38a31e51499a
https://github.com/mozilla-firefox/firefox/commit/c04413f815e5
https://hg.mozilla.org/releases/mozilla-beta/rev/349c5120e45b

Comment 25

[Vasilica Tamas (Android QA) [:vtamas]]

Attachment: Bookmarks:History.mp4

This issue is verified as fixed for bookmarks and history but it still reproduces for search groups - issue tracked in a separate bug 1971723. The testing was performed on Firefox for Android Nightly 141 (2025-06-11) and Firefox 140 beta 8 on Samsung S24 Ultra (Android 15), Google Pixel 8 (Android 15), Poco M4 Pro (Android 12).