526649 - update whitelist service to support arbitrary add-on id's as long as they come from firefoxgear.com

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P2)

Description

[Nick Nguyen [:osunick]]

To make the install experience better for Firefox Gear visitors, we need to enhance the whitelist service so that we can pass in an add-on id and it will serve an add-on without showing the yellow bar.  This should only work when firefoxgear.com is the referrer- but if users copy this link they still get the file, just with a yellow bar.

Comment 1

[Michael Morgan [:morgamic]]

What is this whitelist service that you speak of?

Comment 2

[Justin Scott [:fligtar]]

services/install.php

Comment 3

[Jeff Balogh (:jbalogh)]

Attachment: let firefoxgear.com install any add-on it wants

For this to work, firefoxgear.com has to set addon_id *and* addon_name in the query string.  /services doesn't have a database or l10n, so all the dynamic stuff has to come from outside.  Isn't that awesome?

This is at the top of install.php:

   @todo if this is going to become widely used or expanded it should have some l10n work done

Comment 4

[Jeff Balogh (:jbalogh)]

fligtar suggests that this may not play nice with caching.  There's no explicit caching right now, but we could add that.  And I could add a Vary header, which should (in theory) take care of proper caching.

Comment 5

[Wil Clouser [:clouserw]]

Comment on attachment 413486 [details] [diff] [review]
let firefoxgear.com install any add-on it wants

Fligtar is right.  On the current page all referrer stuff is done in JS because of the caching.

Vary is a nice idea, but just doing it in js is consistent and quick.

Comment 6

[Jeff Balogh (:jbalogh)]

Attachment: special-case referrals from firefoxgear.com

Comment 7

[Wil Clouser [:clouserw]]

Comment on attachment 413647 [details] [diff] [review]
special-case referrals from firefoxgear.com

I think that'll work

Comment 8

[Jeff Balogh (:jbalogh)]

r56607

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

Is this possible to verify without firefoxgear.com live yet?  If so, a succinct testcase would be most appreciated :-)

Comment 10

[Jeff Balogh (:jbalogh)]

Here goes:

The url: https://preview.addons.mozilla.org/services/install.php?addon_id=2848&addon_name=Hi+Stephen

Using tamperdata, add this header: 'Referer: http://firefoxgear.com'.

See what happens.  I didn't actually try this.  And "Referer" is not a typo.

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot, TamperData setup

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot 2: The Sequel; install prompt

Comment 13

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; thanks, Jeff!