293420 - Page Auto Downloads Unwanted File

Status: VERIFIED DUPLICATE of bug 232564

(Toolkit :: Downloads API, defect)

Description

[IKKY]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

This page auto downloads a file using a meta tag...

<meta http-equiv="refresh"
content="0;url=http://stephan.com/widgets/zaptastic/zaptastic.wdgt.zip">

.... I did not want this file to be downloaded, when I tried IE 6.0 with sp2, it
blocked the file from being downloaded.... 

I have the download setting to save all files in this directory, If I change it
to Ask me where to save, it would not matter.

Reproducible: Always

Steps to Reproduce:
1.Go to that site...  http://stephan.com/widgets/zaptastic/
2.Wait and a file will be downloaded
3.If repeated multiple copies would be in the temp folder

Actual Results:  
You get a file that u did not want

Expected Results:  
Gave you a warning thing, like when firefox blocks a popup.

This could probably be linked to the latest extension exploit

Comment 1

[Matthias Versen [:Matti]]

I think this is invalid/wontfix and this isn't linked with any exploit.
Many pages are using the meta refresh for downloading, for example
http.//www.betanews.com.

If a user selects that such a filetype should be always saved without asking,
then FF must do that or the users would be unhappy.

But there is a small difference between FF and Mozilla. 
In Mozilla you have a "Always ask me before handling files of this type" for
helper apps.

Comment 2

[Phil Ringnalda (:philor)]

Actually, with a fresh profile, you have exactly the same thing in both: a
prompt which will let you choose to always save without asking. In the suite,
where everything's more difficult, it's slightly more difficult to change to not
ask where to save, but it's still possible.

Still, we should probably ask anyway when it's not user initiated, but that's a dup.

*** This bug has been marked as a duplicate of 232564 ***