"service windows" should be limited to same domain as provider/worker

RESOLVED FIXED

Status

()

Firefox
SocialAPI
RESOLVED FIXED
5 years ago
3 years ago

People

(Reporter: markh, Assigned: mixedpuppy)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [Fx16])

(Reporter)

Description

5 years ago
The "social window" (ie, the popup windows rather than the sidebar windows) should be limited to being from the same origin as the worker.  Bug 763839 asks for the status bar to be removed as showing the location of the window has "little value" - but that is only true if there is some certainty it is hosted by the provider which opened it.  Further, windows wanting a "generic" popup window is still free to use window.open to get one.
(Reporter)

Updated

5 years ago
Blocks: 763839
(Assignee)

Updated

5 years ago
Whiteboard: [ms1]

Updated

5 years ago
Whiteboard: [ms1] → [Fx16]

Comment 1

5 years ago
Who is going to tackle this? We can't have unowned 16 bugs.
(Assignee)

Comment 2

5 years ago
I'll take this
Assignee: nobody → mixedpuppy
(Assignee)

Comment 3

5 years ago
fixed for addon in https://github.com/mozilla/socialapi-dev/commit/4cd5018c32da2e353ca64265bf4e4e944a2c3a6a

This should as well be a part of landing the service window.
(Assignee)

Updated

5 years ago
Blocks: 770695

Comment 4

5 years ago
(In reply to Shane Caraveo (:mixedpuppy) from comment #3)
> fixed for addon in
> https://github.com/mozilla/socialapi-dev/commit/
> 4cd5018c32da2e353ca64265bf4e4e944a2c3a6a
> 
> This should as well be a part of landing the service window.

Shane, can you explain what "fixed for addon" means? Why is this being fixed in an add-on and not in Firefox where we have a swift approaching deadline?
(Assignee)

Comment 5

5 years ago
(In reply to Asa Dotzler [:asa] from comment #4)
> (In reply to Shane Caraveo (:mixedpuppy) from comment #3)
> > fixed for addon in
> > https://github.com/mozilla/socialapi-dev/commit/
> > 4cd5018c32da2e353ca64265bf4e4e944a2c3a6a
> > 
> > This should as well be a part of landing the service window.
> 
> Shane, can you explain what "fixed for addon" means? Why is this being fixed
> in an add-on and not in Firefox where we have a swift approaching deadline?

The patch to land would come from the addon presumably, and would be ready after the frameworker hits m-c.

Comment 6

5 years ago
(In reply to Shane Caraveo (:mixedpuppy) from comment #5)
> (In reply to Asa Dotzler [:asa] from comment #4)
> > (In reply to Shane Caraveo (:mixedpuppy) from comment #3)
> > > fixed for addon in
> > > https://github.com/mozilla/socialapi-dev/commit/
> > > 4cd5018c32da2e353ca64265bf4e4e944a2c3a6a
> > > 
> > > This should as well be a part of landing the service window.
> > 
> > Shane, can you explain what "fixed for addon" means? Why is this being fixed
> > in an add-on and not in Firefox where we have a swift approaching deadline?
> 
> The patch to land would come from the addon presumably, and would be ready
> after the frameworker hits m-c.

OK. Thanks for that info. I think frameworker just landed (on inbound?) and will make the next m-c merge? Will you port the add-on change to a patch here for review?
(Assignee)

Comment 7

5 years ago
(In reply to Asa Dotzler [:asa] from comment #6)
> (In reply to Shane Caraveo (:mixedpuppy) from comment #5)
> > (In reply to Asa Dotzler [:asa] from comment #4)
> > > (In reply to Shane Caraveo (:mixedpuppy) from comment #3)
> > > > fixed for addon in
> > > > https://github.com/mozilla/socialapi-dev/commit/
> > > > 4cd5018c32da2e353ca64265bf4e4e944a2c3a6a
> > > > 
> > > > This should as well be a part of landing the service window.
> > > 
> > > Shane, can you explain what "fixed for addon" means? Why is this being fixed
> > > in an add-on and not in Firefox where we have a swift approaching deadline?
> > 
> > The patch to land would come from the addon presumably, and would be ready
> > after the frameworker hits m-c.
> 
> OK. Thanks for that info. I think frameworker just landed (on inbound?) and
> will make the next m-c merge? Will you port the add-on change to a patch
> here for review?

Yes, this change would land as part of bug 770695 which I just created (there was no bug to track landing the chat window).
(Assignee)

Comment 8

5 years ago
In fact, I am going to resolve this as fixed as it would land as part of bug 770695
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED

Comment 9

5 years ago
(In reply to Shane Caraveo (:mixedpuppy) from comment #8)
> In fact, I am going to resolve this as fixed as it would land as part of bug
> 770695

Thanks for helping me understand this, Shane. I apologize if I'm coming across as nagging. There are lots of people asking me where we're at with these features so I'm asking more questions than I normally would be. The "Eye of Sauron" is upon us :)
You need to log in before you can comment on or make changes to this bug.