743412 - navigator.mozApps.install -- treatment of origin

Status: VERIFIED FIXED

(Web Apps :: HTML, defect)

Description

[[e-mail] [:onecyrenus]]

If a manifest does not have an origin, it is expected that the app can only be installed from the domain of the app. 

Basically the rules below are slightly different.  Looking at the case where there is no installs_allowed_from, the html/js code will not allow you to install the app, but the ff central code will allow you to install the app. 


html / js code: 
    if (manifestToInstall && manifestToInstall.installs_allowed_from) {
      var iaf = manifestToInstall.installs_allowed_from;
      for (var i = 0; i < iaf.length; i++) {
        if (iaf[i] === '*' || urlMatchesDomain(installOrigin, iaf[i])) {
          return true;
        }
      }

ff central code dom/base/Webapps.js: 
    if (aManifest.installs_allowed_from) {
      ok = false;
      aManifest.installs_allowed_from.forEach(function(aOrigin) {
        if (aOrigin == "*" || aOrigin == aInstallOrigin)
          ok = true;
      });
      return ok;
    }

Comment 1

[Ian Bicking (:ianbicking)]

The code looks logically the same to me.  Can you give an example of a manifest where they act differently?

Comment 2

[Ian Bicking (:ianbicking)]

Looking at the larger context of the code I see what you mean.  Fixed in the HTML implementation in https://github.com/mozilla/openwebapps/commit/7cf0313513f9bab8cc963a96ebe382ae469616bf (not deployed yet)