64737 - Capabilities configurable by trigger

Status: RESOLVED WONTFIX

(Core :: Security, enhancement, P3)

Description

[Ben Bucksch (:BenB)]

Split-off from bug 29346.

I wrote at 2001-01-07 06:04:
> Making the suggestion a bit more general, it would be cool to have classes of
> "triggers" (onload, onclose, onclick, oncommand etc.) as well as classes of
> actions and allowing the user to forbid or allow only combinations of them.

E.g. in order to disable pop-up ads, but allow pop-up windows caused by clicking
on a "link", it would be useful to set the en-/disabling of the function
window.open depending on where the function has been called. In the example, I
would disallow window.open in onLoad / onUnload (for http sites), but allow it
in onclick "scripts".

mstoltz commented at 2001-01-08 10:47:
> is the gain really worth the effort of
> adding a whole new dimension to the security manager?

I don't know :).

Comment 1

[Jesse Ruderman]

Bug 33448 might depend on this bug.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Nice idea. If you know someone who wants to implement it (Ben, want to give it a
try?) they are welcome to it.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Personally, I think this would add too much complexity to the security model,
which is already complex enough. But if someone else wants to implement it...

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.5, Priority P2.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Let's revisit this, now that we have a primitive mechanism in place (see bug
92955). This should be generalized so that it can apply to more event types and
any DOM property.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

*** Bug 99093 has been marked as a duplicate of this bug. ***

Comment 7

[Adam Lock]

See bug 99093 for reasons why you might want to implement this.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

time marches on. Retargeting to 0.9.6.

Comment 9

[Mitchell Stoltz (not reading bugmail)]

performance, footprint, feature work, and re-architecture bugs will be addressed
in 0.9.8

Comment 10

[Garth Wallace]

As nice as this would be, I don't see why it can't wait until post-1.0. The
dom_disable_during_load pref is good enough for the time being, really.

Comment 11

[SineSwiper]

I seconded the idea on bug 38966 (the UI for security prefs), and was redirected
to this bug.  Voting for this bug because it seems like a good idea.

Comment 12

[Mitchell Stoltz (not reading bugmail)]

Future

Comment 13

[Boris Zbarsky [:bzbarsky]]

*** Bug 188259 has been marked as a duplicate of this bug. ***

Comment 14

[Mitchell Stoltz (not reading bugmail)]

*** Bug 185384 has been marked as a duplicate of this bug. ***

Comment 15

[Sylvestre Ledru [:Sylvestre]]

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information

Comment 16

[Daniel Veditz [:dveditz]]

Capabilities are long gone