391340 - SetFullScreen doesn't throw when set by untrusted caller

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Michael Ventnor]

Under SetFullScreen(), if IsCallerTrustedForWrite returns false, we still return NS_OK. This is wrong, we should return a security error so callers know that they don't have the right to set it.

Comment 1

[Michael Ventnor]

Attachment: Patch

Huh, I thought I attached this patch...

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

.fullscreen is supported by IE too, right? Does it throw something when web pages
try to set it? If it doesn't, I think we shouldn't either.

Comment 3

[Michael Ventnor]

Comment on attachment 275750 [details] [diff] [review]
Patch

(In reply to comment #2)
> .fullscreen is supported by IE too, right? Does it throw something when web
> pages
> try to set it? If it doesn't, I think we shouldn't either.

I don't think its supported is modern IE's, but now that you mentioned it I guess that is an obstacle. If we ultimately don't take this patch then current behaviour should probably be documented.

Comment 4

[Martijn Wargers (dead)]

This is still working: http://people.mozilla.com/~mwargers/tests/dom/fullscreenyes.htm

So this document is currently completely wrong:
https://developer.mozilla.org/en/DOM/window.fullScreen

I guess it should also be described here then that you can use the fullScreen property:
https://developer.mozilla.org/en/DOM/Using_full-screen_mode

Comment 5

[Martijn Wargers (dead)]

Is this bug still relevant now that that other bug has been fixed?

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.