As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact bugzilla-admin@mozilla.org
Last Comment Bug 595260 - Extension for whitelisting remote XUL on sites
: Extension for whitelisting remote XUL on sites
Status: RESOLVED FIXED
: dev-doc-complete
Product: Core
Classification: Components
Component: XUL (show other bugs)
: unspecified
: All All
: -- normal with 1 vote (vote)
: ---
Assigned To: Jorge Villalobos [:jorgev]
:
: Neil Deakin
Mentors:
Depends on: kill-remote-xul
Blocks:
  Show dependency treegraph
 
Reported: 2010-09-10 11:13 PDT by dwitte@gmail.com
Modified: 2010-09-29 00:20 PDT (History)
17 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description User image dwitte@gmail.com 2010-09-10 11:13:57 PDT
We should have an extension to add permmgr exceptions for loading of remote XUL from sites. This is trivial to do (and there are lots of examples in our codebase). Volunteers appreciated!

(This should be dev-doc-needed once we have the extension.)

Core:XUL isn't exactly a great place for this, but I don't know that we have a component for writing extensions.
Comment 1 User image Eric Shepherd [:sheppy] 2010-09-10 11:21:30 PDT
Adding doc needed flag now; it won't show up in my "stuff to write" list until this bug gets marked as fixed anyway. I only see stuff that's both doc needed and resolved.
Comment 2 User image Jonas Sicking (:sicking) No longer reading bugmail consistently 2010-09-10 11:23:44 PDT
Actually, why not make the extension a generic "modify what's in permissions manager"? Similar to about:config for prefs.
Comment 3 User image dwitte@gmail.com 2010-09-10 11:39:34 PDT
And whaddaya know -- we have one! https://addons.mozilla.org/en-US/firefox/addon/7385/

I love our community.

It needs to be updated for 4, and tweaked to include remote XUL. (And perhaps to allow a custom consumer string for the truly daring.)
Comment 4 User image Steffen Wilberg 2010-09-16 04:30:00 PDT
The Permissions tab in Page Info already allows to set permissions for the current site for load images, open pop-ups, set cookies, install add-ons, share location, and maintain offline storage.

I guess I could write a patch to add another toggle. The question is whether that would be accepted for Firefox proper?
Comment 5 User image dwitte@gmail.com 2010-09-16 09:20:07 PDT
I don't think so. This shouldn't really be user-facing. We should update the existing extension, or write a separate one.

I'll contact the author and see if he's willing to update his...
Comment 6 User image Jorge Villalobos [:jorgev] 2010-09-28 08:13:09 PDT
I've created a new extension specifically aimed at managing Remote XUL permissions: https://addons.mozilla.org/en-US/firefox/addon/235281/. It's very simple at the moment but I'm planning on adding more features in the near future.
Comment 7 User image dwitte@gmail.com 2010-09-28 11:52:45 PDT
Nice! Can we close this out, then?
Comment 8 User image Eric Shepherd [:sheppy] 2010-09-28 12:17:35 PDT
This is linked to from:

https://developer.mozilla.org/en/Remote_XUL and
https://developer.mozilla.org/en/Using_Remote_XUL

And from Fx4 for developers
Comment 9 User image Jonas Sicking (:sicking) No longer reading bugmail consistently 2010-09-28 12:35:27 PDT
Yay! Thanks Jorge!
Comment 10 User image dwitte@gmail.com 2010-09-28 12:44:36 PDT
Looked at the docs and tested the extension; they look good to me, so I think we can close this out. Requests for additional features can be filed separately.
Comment 11 User image Brendan Eich [:brendan] 2010-09-28 20:33:39 PDT
Yay, Jorge!

/be

Note You need to log in before you can comment on or make changes to this bug.