56260 - "Remember this decision" always active

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[Oliver Fels]

When accessing a site with a signed script which applies enablePrivilege, the
checkbox in the "Remember this decision" dialog seems to be active by default.
This is a major security flaw as it leads to misunderstandings and confusion.

Comment 1

[Asa Dotzler [:asa]]

setting bug status to New.  Oliver Fels, what behavior do you expect, not
checked by defualt or a different message explaining the default?

Comment 2

[Oliver Fels]

It should be unchecked by default.
The current setting makes it too easy for users for just clicking away the message without having noticed the dialog. The user should actively grant that he doesn't want to be bothered with that security issue again by checking the box and presseing OK.

Comment 3

[John Unruh]

Mass changing QA to ckritzer.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Mass adding mozilla0.9 keyword (mass changing milestone doesn't seem to work).

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestone to Moz1.0 - stuff targeted for late spring/early summer.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.5, Priority P1.

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Moving up to 0.9.4

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch - change the default setting of the checkbox

Comment 9

[Johnny Stenback (:jst)]

sr=jst

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Fix checked in.

Comment 11

[bsharma]

Verified on
build: 2001-09-13-0.9.4
platform: Win NT

The checkbox is now not active by default.