344267 - Downloads not initiated by user should use notificationbox

Status: NEW

(Firefox :: General, defect)

Description

[Dietrich Ayala (:dietrich)]

Giving the second half of bug 315536 it's own bug, as it's a quite different problem.

For downloads that are not the result of direct user action (eg: a click), the xul notificationbox should be used to notify the user, instead of the modal download dialog.

Example UI from Beltzner:

{ Download %S from %S?                        [ Download ] [ Cancel ] }

Comment 1

[PikeUK]

Duplicate of bug 232564?

Comment 2

[:aceman]

Looks like that. This bug wants a notification, bug 232564 has more security in mind. I'll mark a relation atleast. 

Comment 3

[:Gavin Sharp [email: [e-mail]]]

*** Bug 347289 has been marked as a duplicate of this bug. ***

Comment 4

[:Gavin Sharp [email: [e-mail]]]

See also bug 347289 comment 1, where Jesse explains why he thinks this should be WONTFIX in favor of his proposed solution to bug 249951.

Comment 6

[Jonas Thiem]

(In reply to comment #4)
> See also bug 347289 comment 1, where Jesse explains why he thinks this should
> be WONTFIX in favor of his proposed solution to bug 249951.

This doesn't serve at all for solving the issue I described in https://bugzilla.mozilla.org/show_bug.cgi?id=543279 as PDF's and other files are possibly malicious aswell.

I'm starting to think that the "Do this always" action is simply flawed by design and should probably be avoided, as any download that gets started and executed immediately without any user confirmation in between is a really huge issue and should never happen.

And sites can do this by prompting the download with a redirect or iframe easily, avoiding the user actually needing to click on a link explicitely to start it.

So either never use "Do This always" for any type of download when it's prompted through a redirect or iframe, or simply remove this feature altogether (or include a warning dialog when people activate it).

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is relatively low, S3. However, the bug has 3 duplicates.
:mossop, could you consider increasing the bug severity?

For more information, please visit auto_nag documentation.

Comment 9

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The last needinfo from me was triggered in error by recent activity on the bug. I'm clearing the needinfo since this is a very old bug and I don't know if it's still relevant.