308383 - inconsistent blocking of extension installation during onload

Status: RESOLVED WONTFIX

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[Levi Wolfe]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; yie6; YPC 3.0.3; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50215)
Build Identifier:  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

Calling InstallTrigger.install() during onload does nothing (bug 238684).  
However, if you set window.location.href, you'll get the whitelist bar at the 
top, or the actual installation prompt if the site is already allowed.

Reproducible: Always

Steps to Reproduce:

Comment 1

[Levi Wolfe]

Attachment: uses window.location.href to attempt automatic installation

Comment 2

[Levi Wolfe]

Attachment: uses InstallTrigger during onload

Comment 3

[Levi Wolfe]

After uploading the attachments, I noticed they both make the whitelist bar
appear if "bugzilla.mozilla.org" isn't in your allowed sites, but only the
window.location.href method can actually pop up the install dialog.

Comment 4

[Daniel Veditz [:dveditz]]

This isn't going to get fixed on the 1.0 branch (not a security exploit), and on
the trunk we've stopped blocking onload installs (see bug 271567). This
shouldn't be an issue.