230676 - Form-submit security warning should not remember decision if cancelled

Status: RESOLVED WONTFIX

(Firefox :: General, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Set security.warn_submit_insecure to true in about:config.
2. Go to http://www.google.com/.
3. Submit the form.
4. Press Esc in the warning dialog.
5. Submit the form again.

Result: the warning dialog does not appear again.

Comment 1

[Jesse Ruderman]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040108
Firebird/0.8.0+ (MozJF)

Comment 2

[baffclan]

I think that there is a problem of security.

Comment 3

[Koike Kazuhiko]

*** Bug 245657 has been marked as a duplicate of this bug. ***

Comment 4

[Asa Dotzler [:asa]]

*** Bug 250895 has been marked as a duplicate of this bug. ***

Comment 5

[Asa Dotzler [:asa]]

related to bug 245655 ?

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

See bug 250895 comment 1 for some possible solutions.

Comment 7

[Pierre Chanial]

I really like that:
> bryner suggested that better user interface here might be:
> [ Cancel ]  [ Continue ]  [Continue, and Don't Ask Again ]

Comment 8

[Pierre Chanial]

Attachment: patch (form submission only)

This patch has been tested for form submission in the two cases
(insecure->insecure) and (secure->insecure) but it exposes more the aviary-only
bug 256953.

Not sure what to do from now.
- review it and let it bake in the trunk.
- change the alerts to make them consistent with the form submission dialog:

You are leaving a secure page blabla...
"OK" "OK, Don't Notify Me Again"

Thoughts?

Comment 9

[Pierre Chanial]

cc'ing dbaron and bryner, since they showed interest in this bug.

Comment 10

[Pierre Chanial]

Note that I forgot to remove the PostToInsecureFromInsecureShowAgain locale in
the patch, because I was thinking of checking in only the new locale in the
branch before the l10n freeze and eventually check in the patch at a later stage.
For the trunk, that locale should be removed.

Comment 11

[baffclan]

I cannot reproduce Firefox(Gecko/20040901)/WinXP.
Fixed/Worksforme?

Comment 12

[Gonzalo HIGUERA DÍAZ]

(In reply to comment #11)
> I cannot reproduce Firefox(Gecko/20040901)/WinXP.
> Fixed/Worksforme?

In Firefox 20040905 from the latest-0.9 branch (under Windows 2000) the problem
still seems to be there when pressing Esc or when clickin on the cross (and
probably on "Cancel" too). Maybe you are security conscious and the boxed is
ticked, in which case the bug may not be so obvious (or not be there at all)
since the resolution of bug 245655.

Comment 13

[Ben Goodger (use ben at mozilla dot org for email)]

Not a "blocker" - too late for l10n 

Comment 14

[John Glenn]

I can't figure out how to get these warnings to show up again, once you have
selected "Don't warn me me again" ... you might fix that at the same time. 

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment 14 is bug 252362, not this bug.

Comment 16

[:Gavin Sharp [email: [e-mail]]]

We don't support warn_submit_insecure=true anymore. (bug 799009, bug 513166)