468526 - Make the blocklist more information url https

Status: VERIFIED FIXED

(Toolkit :: Add-ons Manager, defect)

Description

[Dave Townsend [:mossop]]

Since we are now only warning users about some items we should be reasonably sure that the more information they see is accurate and not spoofed to say something less worrying.

Comment 1

[Dave Townsend [:mossop]]

Attachment: patch rev 1

Simple patch

Comment 2

[Dave Townsend [:mossop]]

reed, is using this https url going to be ok? It seems to work to me right now.

Comment 3

[Reed Loden [:reed]]

https is fine, but it would be preferred if you went ahead and changed it to "https://www.mozilla.com/%LOCALE%/blocklist/". Bug 454300 has a patch to remove the locale subdomain, but it's pending an AMO fix that I'm going to try to get done this week.

Comment 4

[Dave Townsend [:mossop]]

Attachment: patch rev 2

Removes the locale subdomain

Comment 5

[Dave Townsend [:mossop]]

Landed: http://hg.mozilla.org/mozilla-central/rev/6bf12c7664b8

Comment 6

[Dave Townsend [:mossop]]

Comment on attachment 355418 [details] [diff] [review]
patch rev 2

A minor security win that we might as well take on the branch, no risk

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 355418 [details] [diff] [review]
patch rev 2

a191=beltzner

Comment 8

[Dave Townsend [:mossop]]

Landed on branch http://hg.mozilla.org/releases/mozilla-1.9.1/rev/273b9ecef4b7

Comment 9

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4
and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090426 Minefield/3.6a1pre