676119 - Create a basic webapp from a manifest URL

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Description

[Kumar McMillan [:kumar]]

Change UI of submission page (https://addons.allizom.org/en-US/developers/addon/submit/2) and backend to accept a URL to manifest and parse out the basic information (see bug 676116)

Comment 1

[Kumar McMillan [:kumar]]

we may need to put some thought into the new upload UI for this so I'm cc'ing potch and gkobes so they can listen in.

Comment 2

[Jeff Balogh (:jbalogh)]

If we auto-fill the Webpage.homepage column with the manifest's URL we can fake the real homepage by filtering out the path part (we'd have to ban homepage editing for webapps). But it might be easier to add a new column pointing at the manifest URL.

P1 because you can't install a webapp without knowing the manifest URL.

Comment 4

[Jeff Balogh (:jbalogh)]

cc'ing infrasec since this will add a new attack surface: the developer will give us a URL and we will download their file onto our server for parsing and validation.

Comment 5

[Michael Coates [:mcoates] (acct no longer active)]

We'll want to take a look at this new feature when its in stage.

Comment 6

[Jeff Balogh (:jbalogh)]

https://github.com/jbalogh/zamboni/commit/225d693 +
https://github.com/jbalogh/zamboni/commit/40a29e3 

I've been using people.mozilla.com/~jbalogh/ztype.webapp to test this.

This is available at https://addons.allizom.org/en-US/developers/addon/submit/1 if the accept-webapps flag is on for you. If you don't see any changes, let me know and we can get you in there.

gkoberger has ever so kindly agreed to make the frontend pretty in bug 679568.

Comment 7

[Raymond Forbes[:rforbes]]

creating a sec bug so we can do a review of this code change.

Comment 8

[Jeff Balogh (:jbalogh)]

(In reply to Raymond Forbes[:rforbes] from comment #7)
> creating a sec bug so we can do a review of this code change.

What's the bug number?