Closed Bug 69457 Opened 19 years ago Closed 19 years ago

The ability of embedding applications to disable the REFRESH meta tag, which can redirect the document to another page.

Categories

(Core Graveyard :: Embedding: APIs, defect, P3)

x86
Windows 98
defect

Tracking

(Not tracked)

VERIFIED FIXED
mozilla0.9

People

(Reporter: bugz, Assigned: radha)

References

Details

Attachments

(2 files)

The ability to disable the REFRESH meta tag, which can redirect the document to 
another page, is needed.
Blocks: 64833
The SH related bug on this 39938 has been fixed.  There is a mechanism in place
to identify META REFRESH based redirections. Look in to
nsDocShell::refreshURI(), nsRefreshTimer::Notify() in nsDocshell.cpp, and
layout/html/document/src/nsHTMLContentSink.cpp
Summary: The ability to disable the REFRESH meta tag, which can redirect the document to another page. → The ability to disable the REFRESH meta tag, which can redirect the document to another page.
Radha, I'm not following. The changes in 39938 apply to manipluating whether or
not redirects go into session history. We need a way to expose disabling of
these redirects.
Blocks: 70229
I will try to implement this for mozilla 0.9. I'm presuming that we can go thro' 
some Prefs to achieve this. 
Assignee: valeski → radha
Priority: -- → P3
Target Milestone: --- → mozilla0.9
We'll need this on a top-level window basis, and prefs are global. For example a
mail viewer won't want to support this, but browser windows would. Scott, how
does mail/news do this?
No longer blocks: 64833
Blocks: 64833
this should be a setting on nsIWebBrowserSetup. maybe something similair to 
http://lxr.mozilla.org/mozilla/source/editor/base/nsEditorShell.cpp#5281 can be 
done?
"refresh" is too generic a term. It can translate to HTTP status code 
refreshing, javascript refreshing, and META refreshing.

I propose renaming if we just want to block META refreshing, then we should 
rename the attribute in nsIDocShell to "allowMETARedirects" and the 
webbrowsersetup code should be renamed to SETUP_ALLOW_META_REDIRECTS .

With that said however, would it be much work indeed make it generic enough to 
block both META *and* javascript redirects? If not, then we should keep your 
naming convention, and modify the implementation to block both.

What do you think?
hey radha,

I took a look at the patch and it looks good...

I think that you should move the test of GetAllowRefreshRedirects(...) up to the
top of the method (say right after checking mDocShell)...

Because, it looks like now, the flag is only being checked if the refresh URI is
different from the current one - so meta-refreshes to the same URI will *not* be
disabled...

Does this sound right?

-- rick
reply to the question: We definitely want to disable META refreshes that 
re-direct, but we can keep them if they are the same URL (ie. Anchors, etc).
Based on marek's comments, the original patch that disables *only* the redirects
stays. I have however renamed the method name in docshell and the flag name in
nsiWebBrowserSetup.idl as per jud's comments. The JS issue is addressed in a
different bug. Can I get a r and sr?  Thanks
Status: NEW → ASSIGNED
r=valeski
If we are going to allow meta-refreshes to the same URI, then we may need
another flag which disables *all* refreshes...  I assume that we will want this
for the editor case, where we don't want a document with a meta-refresh to fire
while it is being edited...

Can we add an argument to AllowRefreshRedirects(...) indicating whether all
redirects, or just "foriegn" ones should be disabled?

I guess I'm also a bit confused as to why redirects to the same URI are "ok"...

-- rick
This was fixed last week.
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Correction: Changing QA contact for the Embed API bugs to David Epstein.
QA Contact: mdunn → depstein
SETUP_ALLOW_META_REDIRECTS flag declared in nsIWebBrowserSetup, used in 
nsWebBrowser.cpp (calls mDocShell->SetAllowMetaRedirects(aValue)).
Status: RESOLVED → VERIFIED
No longer blocks: 64833
Sorry to ask a stupid question, but what is the name of the
preference that I need to add to user.js (or about:config)
in order to activate this fix and disable META refresh?
I've tried everything I can think of, and no go.
Thanks.
It looks like the fix vanished without a trace soon after it was put in.  It has
cropped up again as bug 83265.
This bug added an embedding API to disable meta-refresh. The code is still there
and presumably still works, but our own browser does not ever set that property.
Blocks: 83265
Summary: The ability to disable the REFRESH meta tag, which can redirect the document to another page. → The ability of embedding applications to disable the REFRESH meta tag, which can redirect the document to another page.
> "refresh" is too generic a term. It can translate to HTTP status code 
> refreshing, javascript refreshing, and META refreshing.

I take it, this API function only covers "META refreshs". Are there already API
calls available for blocking "Javascript refreshs" and "HTTP 301 Redirects"?
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.