294323 - function onFullScreen() should check for untrusted events

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[Jochen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Go to http://www.krickelkrackel.de/testing/fullscreen.htm
and see some toolbars and the statusbar go away.

I don't know if this is security related, but it makes 
spoofing easier.

Reproducible: Always

Actual Results:  
Missing chrome.


Expected Results:  
I think that this should not be possible.

Comment 1

[Daniel Veditz [:dveditz]]

You're right this shouldn't happen, but it's more of an annoyance than a
security exploit. Might be fairly permanent though: most users probably don't
know about fullscreen mode and wouldn't be able to figure out how to get their
toolbars or menus back (F11 twice) -- especially since any hints on the View
menu are invisible too.

When bug 289940 is fixed this should get fixed for free, but leaving open so we
remember to retest to be sure.

Comment 2

[Hixie (not reading bugmail)]

bug 289940 _is_ fixed.

Comment 3

[Daniel Veditz [:dveditz]]

This is fixed on the trunk.

*** This bug has been marked as a duplicate of 289940 ***

Comment 4

[Daniel Veditz [:dveditz]]

Bug 289940 isn't going to land on the branch, reopening for reconsideration.

Comment 5

[Daniel Veditz [:dveditz]]

OK, looks like bug 289940 is wanted on the branch. Either way, plussing to make
sure this one is fixed one way or the other

Comment 6

[Daniel Veditz [:dveditz]]

This is fixed on the trunk by bug 289940. I didn't need to reopen to keep in
consideration for a 1.0-branch fix, the blocking flag takes care of that.

Comment 7

[Daniel Veditz [:dveditz]]

Attachment: testcase copied to bug in case remote server goes away

Comment 8

[Daniel Veditz [:dveditz]]

fix for bug 289940 checked into aviary and mozilla 1.7 branches

Comment 9

[Jay Patel [:jay]]

v.fixed on aviary with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.9)
Gecko/20050706 Firefox/1.0.5 using original testcase.

Comment 10

[Daniel Veditz [:dveditz]]

Adding distributors

Comment 11

[Daniel Veditz [:dveditz]]

FF1.0.5 advisories published

Comment 12

[Jochen]

Thanks for fixing!