779227 - Security warning keeps coming back and blocks use of today's nightly with social.enabled = true

Status: RESOLVED WONTFIX

(Firefox Graveyard :: SocialAPI, defect)

Description

[Lukas Blakk [:lsblakk] use ?needinfo]

Attachment: screenshot with session restore screen & sec popup

STR:

1. Created a new profile
2. Opened Nightly (it was from 6/27 I believe)
3. Went to about:config and created social.enabled, set to true
4. Restarted browser, browser opens with Social sidebar
5. Checked for updates and got today's Nightly update, downloaded restarted to update
6. Now on start there is a warning for security that cannot be dismissed (window keeps coming back on "OK" click)

I had to force quit, and on second or third re-opening I got session restore and still had the security popup blocking me which is why this definitely looks like social api.

Comment 1

[Lukas Blakk [:lsblakk] use ?needinfo]

Attachment: screenshot with normal tabs, social sidebar & security popup

Comment 2

[Mark Hammond [:markh] [:mhammond]]

FWIW, I can't repro this.

Comment 3

[Simon C. Wex]

The template code was loading some non-ssl resources from gravatar. I'll push the change out shortly.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Separately from the current motown issue, we should try to harden the client against this kind of problem in general (and other potential dialogs that may appear), so if that's not going to be tracked in this bug we should get another one on file.

Comment 5

[Jared Wein [:jaws] (please needinfo? me)]

I talked with Brian Smith and Sid Stamm and we can probably use CSP here to restrict all content to be over HTTPS. See bug 768029 for how CSP is being applied to apps.

Comment 6

[Shane Caraveo (:mixedpuppy)]

motown is gone, closing.

Comment 7

[:Gavin Sharp [email: [e-mail]]]

Looking at it as a "we should handle crazy things providers do" point of view, though, we should still make sure we're covered here.

Thankfully bug 799009 got rid of most of the dialogs that could possibly appear in these situations. The dialog that occurs when submitting a form to an insecure site from a secure site is still around, though. We could do work to try to avoid that from appearing from social panels, but maybe it's not worth the effort.