Closed
Bug 32941
Opened 25 years ago
Closed 25 years ago
enablePrivilege non-functional, stops script if no PSM.
Categories
(Core :: Security, defect, P3)
Tracking
()
M15
People
(Reporter: brk, Assigned: dougt)
References
Details
Any attempt to call netscape.security.PrivilegeManager.enablePrivilege without
the PSM installed fails silently, without throwing an exception, it simply stops
the execution of the script. Note that signing the script is ineffective, as is
enabling codebase principals. The PSM must be installed. Sample code follows.
<html>
<head>
<script id = "yup" archive="test.jar" language="javascript">
function useJava() {
try {
alert("Trying...");
netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead");
netscape.security.PrivilegeManager.enablePrivilege("UniversalPropertyRead");
netscape.security.PrivilegeManager.enablePrivilege("UniversalPropertyWrite");
alert("Success!");
} catch (e) {
alert("Error occurred.");
alert(e);
}
}
</script>
</head>
<body>
<input type="button" value="Click me" onclick="useJava()"/>
</body>
</html>
|
||
Updated•25 years ago
|
Assignee: rogerl → norris
Component: Javascript Engine → Security: General
QA Contact: rginda → junruh
|
|
||
Comment 2•25 years ago
|
||
Which begs the question of whether
netscape.security.PrivilegeManager.enablePrivilege should throw exceptions back
into JS, but that's the Security group's concern.
|
||
Updated•25 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
|
|
||
Comment 3•25 years ago
|
||
enablePrivilge shouldn't require PSM if we're only worried about unsigned scripts.
Reassign to mstoltz.
Assignee: norris → mstoltz
|
||
Comment 4•25 years ago
|
||
I see no relationship to PSM here. I ran your script with and without PSM
installed, I see the grant privilege dialog, and if I click Don't Enable,
Javascript throws an exception. Marking WORKSFORME.
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → WORKSFORME
|
||
Comment 5•25 years ago
|
||
Reopening. There is a new behavior here. I've saved the code below as a file
"grant.html"
1) Visit http://junruh/grant.html
2) Click on Click Me. An alert appears saying "Trying". Click OK. Next you see
"error occurred", then "enablePriviledge not granted".
3) Visit https://junruh/grant.html. PSM should load automatically.
4) Click on Click Me.
What happens: I am asked to save a file as test/cached-xul.
What is expected: The same results as step 2.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
|
|
||
Comment 6•25 years ago
|
||
Looks like https is having a mime-type problem.
Reassigning to dougt since it's https.
Assignee: mstoltz → dougt
Status: REOPENED → NEW
|
Assignee | |
Comment 7•25 years ago
|
||
no mime type problem... netscape.security.PrivilegeManager.enablePrivilege is
not implemented.
javi@netscape.com, this is similar to what you are working on now. over to you
for evauluation.
Assignee: dougt → javi
Blocks: 13785
|
||
Comment 8•25 years ago
|
||
Is this with viewing signed JavaScript? I'm not sure what the netscape object
you guys are reffering to is all about.
dougt@netscape.com, this is similar to what thing that I'm working on? This
doesn't appear to be related to the crypto object. Seems that something else
that needs to be added to the glue.
|
|
Assignee | |
Comment 9•25 years ago
|
||
I was suggesting that since you have other js object that need to be reflected
into the mozilla DOM, you could also look into doing this as well. On thinking
about this a bit more, I think Norris's group should implement this.
mstoltz, is the "PrivilegeManager" something that you need?
|
|
||
Comment 10•25 years ago
|
||
netscape.security.PrivilegeManager.enablePrivilege _is_ implemented, in caps/src/
nsScriptSecurityManager.cpp. As junruh's description says, enablePrivilege works
as expected when loading over http (it wouldn't generate an "EnablePrivilege not
granted" exception if the function wasn't implemented), but when loaded over
https, I don't think the script runs at all. I'm not sure who this should be
assigned to, but I still think the problem is with mime-types somehow.
|
|
Assignee | |
Comment 11•25 years ago
|
||
two bugs here:
First the regression that john pointed out. This effected all of our common
dialogs that we use in PSM. See 34607, 34608. They all have the root problem
of display the UCTH dialog. This first part should be fixed in m15 as it is a
regression.
Second the bug that brk@jenkon.com initally reported. I am not sure when this
needs to be fixed. norris or mstoltz could answer this better.
Assignee: javi → dougt
Target Milestone: --- → M15
|
|
||
Comment 12•25 years ago
|
||
I couldn't reproduce the bug that brk@jenkon.com initally reported; I've never
seen that behavior. It's a WORKSFORME.
|
|
Assignee | |
Comment 13•25 years ago
|
||
mime type problem that mitch referred to is caused by 34769.
*** This bug has been marked as a duplicate of 34769 ***
Status: NEW → RESOLVED
Closed: 25 years ago → 25 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•