Closed Bug 21559 Opened 25 years ago Closed 25 years ago

[SECURITY][DOGFOOD]XPI confirm buttons pushed off dlg if too many components

Categories

(Core Graveyard :: Installer: XPInstall Engine, defect, P3)

All
Other
defect

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: dveditz, Assigned: dbragg)

Details

(Whiteboard: [PDT+]Fix in hand)

When components are added to the XPI confirmation dialog each component pushes the buttons down a line, and eventually off the dialog (see the commercial "update.html" page for an example). When this happens the user can do nothing but close the dialog, which due to another bug (21558) means the user can only *approve* the install. This is a huge security risk--a malicious person could trigger a multi-install with enough padding to force the user to accept the install. If the download were small enough the user might not be able to kill Mozilla or the connection in time to stop it. This is *further* compounded by the fact that the "cancel" button on the subsequent download dialog causes the dialog to go away, but does NOT halt the install -- giving the user the impression they have done enough to protect themselves.
Target Milestone: M12
Status: NEW → ASSIGNED
Accepting. I've got a simple fix for the "close" part of this bug. I'm working on either getting a scroll bar for the tree control or making the dialog expand with the input.
Whiteboard: [PDT-]
Putting on PDT- radar. You should install the whole thing, no piece meal.
Whiteboard: [PDT-] → Fix in hand
This has nothing to do with *our* installs or how we deliver dogfood. This is a SECURITY HOLE that others can exploit to install and run viruses or trojans on your machine. We have a fix
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Fixed using a new skin file that lays out the tree control. The control now uses scroll bars if there are more then 6 triggers in one multiple trigger. If it is determined that more than 6 should be visible, we can easily change it in the future.
Whiteboard: Fix in hand → [PDT+]Fix in hand
Putting on PDT+ radar.
Status: RESOLVED → VERIFIED
Build 1999-12-14-09-M12(WIN), 1999-12-14-08-M12(MAC), 1999-12-14-11-M12(LINUX) All is well. Open http://jimbob/jars/f_multitrigger_lotsa.html. This test is only for testing the confirmation dialog.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.