277041 - Add fixed text to install alert/confirm titles

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Installer: XPInstall Engine, enhancement)

Description

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

Bug 216399 added the ability for confirm() to set the dialog title, and by
default uses the install's "pretty name" as the title.

There should probably be some fixed text in case the pretty name is blank or
spoofed. This applies to the extended confirmEx() features added by bug 216399
as well (like "[Javascript application]" in a webscript confirm()).

Note that a malicious installer trying to spoof a dialog can already screw you
up by installing chrome or binaries. This is more to limit user
surprise/confusion than any actual security protection. Maybe it isn't even
necessary.

The confusion comes from a alert dialog with a title, for example, "Linky 2.0".
It's not really Linky 2.0 putting up the text, you don't have linky 2.0 yet. The
install may even go on to fail, but might leave the impression it was already
running because the user saw the title (OK, maybe a little far-fetched).

Maybe a localized template "Installation of %s" or "%s installation".

Comment 1

[Jens Bannmann]

For regular alert() and confirm() I'd go with "%s installation", with fallback
to "Confirm"/"Alert".

For the extended confirm() I can imagine two alternatives (where %N is the
UIName and %T is the script-supplied title arg):
- "%N - %T installation" -> "Choose location - Mouse Gestures installation".
This would somehow match the "web page title - Mozilla" scheme in the window
title, but looks a bit strange...
- "%T installation: %N" -> "Mouse Gestures installation: Choose location". Looks
way better.

However, in either case, I've got no idea what the fallback in case of an empty
UIName should be...

Comment 2

[Jens Bannmann]

Re-reading comment 1, I just realized I mixed up %N and %T, so just stick with
the examples.