User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3 This page auto downloads a file using a meta tag... <meta http-equiv="refresh" content="0;url=http://stephan.com/widgets/zaptastic/zaptastic.wdgt.zip"> .... I did not want this file to be downloaded, when I tried IE 6.0 with sp2, it blocked the file from being downloaded.... I have the download setting to save all files in this directory, If I change it to Ask me where to save, it would not matter. Reproducible: Always Steps to Reproduce: 1.Go to that site... http://stephan.com/widgets/zaptastic/ 2.Wait and a file will be downloaded 3.If repeated multiple copies would be in the temp folder Actual Results: You get a file that u did not want Expected Results: Gave you a warning thing, like when firefox blocks a popup. This could probably be linked to the latest extension exploit
I think this is invalid/wontfix and this isn't linked with any exploit. Many pages are using the meta refresh for downloading, for example http.//www.betanews.com. If a user selects that such a filetype should be always saved without asking, then FF must do that or the users would be unhappy. But there is a small difference between FF and Mozilla. In Mozilla you have a "Always ask me before handling files of this type" for helper apps.
Actually, with a fresh profile, you have exactly the same thing in both: a prompt which will let you choose to always save without asking. In the suite, where everything's more difficult, it's slightly more difficult to change to not ask where to save, but it's still possible. Still, we should probably ask anyway when it's not user initiated, but that's a dup. *** This bug has been marked as a duplicate of 232564 ***