21559 - [SECURITY][DOGFOOD]XPI confirm buttons pushed off dlg if too many components

Status: VERIFIED FIXED

(Core Graveyard :: Installer: XPInstall Engine, defect, P3)

Description

[Daniel Veditz [:dveditz]]

When components are added to the XPI confirmation dialog each component pushes
the buttons down a line, and eventually off the dialog (see the commercial
"update.html" page for an example).

When this happens the user can do nothing but close the dialog, which due to
another bug (21558) means the user can only *approve* the install. This is a
huge security risk--a malicious person could trigger a multi-install with
enough padding to force the user to accept the install. If the download were
small enough the user might not be able to kill Mozilla or the connection in
time to stop it.

This is *further* compounded by the fact that the "cancel" button on the
subsequent download dialog causes the dialog to go away, but does NOT halt the
install -- giving the user the impression they have done enough to protect
themselves.

Comment 1

[dbragg]

Accepting.  I've got a simple fix for the "close" part of this bug.  I'm working
on either getting a scroll bar for the tree control or making the dialog expand
with the input.

Comment 2

[leger]

Putting on PDT- radar.  You should install the whole thing, no piece meal.

Comment 3

[Daniel Veditz [:dveditz]]

This has nothing to do with *our* installs or how we deliver dogfood. This is a
SECURITY HOLE that others can exploit to install and run viruses or trojans on
your machine. We have a fix

Comment 4

[dbragg]

Fixed using a new skin file that lays out the tree control.  The control now
uses scroll bars if there are more then 6 triggers in one multiple trigger.  If
it is determined that more than 6 should be visible, we can easily change it in
the future.

Comment 5

[leger]

Putting on PDT+ radar.

Comment 6

[Jimmy Lee]

Build 1999-12-14-09-M12(WIN), 1999-12-14-08-M12(MAC), 1999-12-14-11-M12(LINUX)

All is well.  Open http://jimbob/jars/f_multitrigger_lotsa.html.  This test is
only for testing the confirmation dialog.