251058 - update patch does install without proper notification

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[Peter van der Woude [:Peter6]]

1.Use a branchbuild Win32 Firefox from before 20040707
2.Click
http://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/experimental/shellblock/shellblock.xpi
to install the shellblock patch.
3.The extension:
a) is unsigned, wich is not good for an official extension
b) installs as intended, but the "extension" is only highlighted for a fraction
of a second before it disappears from the extensionmanager panel.

based on .3 either the extension is installed succesfully or has failed
(different bug).
Unless you look in about:config you can never be sure it is installed.

Suggestion, especially for security patches, as soon as the extension/patch is
installed a popup should appear either confirming the completed installation of
the patch or tell you to close Firefox and restart to complete installation.

In case of the latter, a popup should appear as soon as you open FF telling you
that the securitypatch is installed.
Silently installing is something that belongs to IE ;-) , show the user what
happens and he will feel more secure.

Comment 1

[Nickolay_Ponomarev]

I wonder why is this a EM bug? It is clearly a shellblock.xpi "bug". That patch
is using old-style install.js, that's why it is not listed in EM, that's by design.
It could use alert() in install.js to tell it was successfully installed.
And how's this a "major loss of function"?
Finally, it is not relevant now, imo.
I suggest resolving this as invalid.

Comment 2

[Peter van der Woude [:Peter6]]

Hard to tell, we haven't had a security patch in a while so I can't tell how it
will behave when it happens.
I know a lot of people installed this extension over and over again because they
thought it had failed.

Comment 3

[Nickolay_Ponomarev]

It will behave the same, unless the install logic of patch itself is chagned. It
is not a EM bug. It needs to be moved to more appropriate component or invalid'ated.

It's not a bug, it's a kind of feedback on extension, shellblock.xpi. Do you
know who made shellblock? This is his.

Comment 4

[Peter van der Woude [:Peter6]]

No I don't have the privs to access the bug that was involved.
I'm pretty sure Ben should know.

I agree that EM is not the proper component, but at the time I didn't know
anything better.
Feel free to change the component.

Comment 5

[Jesse Ruderman]

dveditz: I'm guessing this is WONTFIX for shellblock.xpi, but it would be nice
if future hotfixes were signed by mozilla.org and said "hotfix applied
successfully" at some point.

Comment 6

[Asa Dotzler [:asa]]

Yes, what Jesse said.