688281 - Port bug 660684

Status: RESOLVED FIXED

(SeaMonkey :: Sync UI, defect)

Description

[Jens Hatlak (:InvisibleSmiley)]

Attachment: patch [Checkin: comments 3 and 6]

Not much to say here since bug 660684 which is to be ported here is still closed. Meanwhile Callek gave me access to that bug but it doesn't contain any real reasoning but points to yet another closed bug 643463.

Callek, I hope you can make sense of this and make a final decision whether this is needed at all (otherwise just FF compat). Consult whoever you feel necessary, and if you add confidential info here, feel free to raise the security level.

This was originally fixed for FF with the following changeset:
http://hg.mozilla.org/mozilla-central/rev/89822eff0816
[and no, we don't need the Content Type header since, unlike FF, we actually save the file as .xhtml]

Comment 1

[Justin Wood (:Callek)]

Comment on attachment 561567 [details] [diff] [review]
patch [Checkin: comments 3 and 6]

I would argue explicitly setting a meta for content-type would be useful (for utf-8 charset here) but that can be another bug.

Comment 2

[Justin Wood (:Callek)]

Marking this bug sec-group so I can tell you why, and because the other bug this ports is still hidden...

Basically there exists the case where Machine Search Services, (Such as Google Desktop Search) can find the sync key, even with unrelated searches based on text in our page here. This can allow other users to get data from sync even if they would otherwise not have access to the users profile, if the sync key is saved in a public place.

This meta directive helps to alleviate this problem.

Comment 3

[Jens Hatlak (:InvisibleSmiley)]

Comment on attachment 561567 [details] [diff] [review]
patch [Checkin: comments 3 and 6]

http://hg.mozilla.org/comm-central/rev/6fd843ebdfcc

Comment 4

[Jens Hatlak (:InvisibleSmiley)]

Comment on attachment 561567 [details] [diff] [review]
patch [Checkin: comments 3 and 6]

Maybe we should even have this on the branches?

Comment 5

[Justin Wood (:Callek)]

Comment on attachment 561567 [details] [diff] [review]
patch [Checkin: comments 3 and 6]

Note beta+ approval is NOT for Gecko 7, as it is too late for that, just a matter of "ok to land on Gecko 8 wherever it is when you get here"

Comment 6

[Jens Hatlak (:InvisibleSmiley)]

Comment on attachment 561567 [details] [diff] [review]
patch [Checkin: comments 3 and 6]

http://hg.mozilla.org/releases/comm-aurora/rev/f22d01143155