Last Comment Bug 793747 - When installing an app, show the origin of the app in the confirmation prompt
: When installing an app, show the origin of the app in the confirmation prompt
Status: VERIFIED FIXED
[blocking-webrtandroid1-] A4A [packag...
: sec-want
Product: Firefox for Android
Classification: Client Software
Component: Web Apps (show other bugs)
: 18 Branch
: ARM Android
: P1 normal (vote)
: Firefox 23
Assigned To: Martyn Haigh (:mhaigh)
: Aaron Train [:aaronmt]
:
Mentors:
Depends on: 813736
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-24 09:47 PDT by Jason Smith [:jsmith]
Modified: 2013-04-18 09:39 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified
+


Attachments
Adding app origin to install dialog (1.36 KB, patch)
2013-04-09 11:38 PDT, Martyn Haigh (:mhaigh)
mark.finkle: review+
Details | Diff | Splinter Review
Screenshot showing install prompt with domain URL (146.07 KB, image/png)
2013-04-09 11:58 PDT, Martyn Haigh (:mhaigh)
no flags Details

Description Jason Smith [:jsmith] 2012-09-24 09:47:19 PDT
Right now when you try to install a web application, we just show up a simple pop-up to confirm installing the application. For security reasons, we should provide a bit more context of where the app is being installed from (i.e. the origin), as that establishes more trust to the user that they know what they are installing. We have implemented this support for desktop and ff os, so we might want to do the same for Android.
Comment 1 Jason Smith [:jsmith] 2012-11-05 12:36:43 PST
Might be worth tracking - the origin is important to show when installing an app as it gives the user context to where the app is being installed from. It also establishes parity with desktop and b2g.
Comment 2 Jason Smith [:jsmith] 2013-01-31 09:49:03 PST
Per talking in the sec-review for b2g app updates, the b2g equivalent was claimed to be a sec-want, especially for packaged app installs. I'm adding the keyword here for the same reason. And also noming for tracking given that security wants this as a safety measure.
Comment 3 Jason Smith [:jsmith] 2013-02-01 17:23:08 PST
(In reply to Jason Smith [:jsmith] from comment #2)
> Per talking in the sec-review for b2g app updates, the b2g equivalent was
> claimed to be a sec-want, especially for packaged app installs. I'm adding
> the keyword here for the same reason. And also noming for tracking given
> that security wants this as a safety measure.

See bug 827562 for context.
Comment 4 Erin Lancaster [:elan] 2013-03-14 08:57:29 PDT
Triage comment: this is for hosted apps to start with.
Comment 5 Erin Lancaster [:elan] 2013-03-14 08:58:47 PDT
Traige comment redux: we should likely have the same behavior for hosted and for packaged, the difference should be transparent to the user.
Comment 6 Jason Smith [:jsmith] 2013-03-14 09:29:30 PDT
(In reply to Erin Lancaster [:elancaster] from comment #5)
> Traige comment redux: we should likely have the same behavior for hosted and
> for packaged, the difference should be transparent to the user.

No, this is definitely what you should not do with packaged apps. A packaged app has no concept of an app origin - it derives itself from an app:// URL. In the case of a packaged app, you should indicate the trusted store that the app is being installed from.
Comment 7 Martyn Haigh (:mhaigh) 2013-04-09 11:38:14 PDT
Created attachment 735316 [details] [diff] [review]
Adding app origin to install dialog

Added app origin to install dialog
Comment 8 Jason Smith [:jsmith] 2013-04-09 11:43:02 PDT
Comment on attachment 735316 [details] [diff] [review]
Adding app origin to install dialog

Review of attachment 735316 [details] [diff] [review]:
-----------------------------------------------------------------

::: mobile/android/chrome/content/browser.js
@@ +6023,5 @@
>      let manifest = new ManifestHelper(jsonManifest, aData.app.origin);
>      let name = manifest.name ? manifest.name : manifest.fullLaunchPath();
>      let showPrompt = true;
>  
> +    if (!showPrompt || Services.prompt.confirm(null, Strings.browser.GetStringFromName("webapps.installTitle"), name + "\n" + aData.app.origin)) {

A packaged app doesn't have a concept of an origin. So what happens here if I try install a packaged app? What do I end up seeing in the install prompt?
Comment 9 Martyn Haigh (:mhaigh) 2013-04-09 11:58:10 PDT
Created attachment 735336 [details]
Screenshot showing install prompt with domain URL

A packaged app will show the base URL of the domain from which the app is being installed.
Comment 10 Jason Smith [:jsmith] 2013-04-09 13:29:39 PDT
(In reply to Martyn Haigh (:mhaigh) from comment #9)
> Created attachment 735336 [details]
> Screenshot showing install prompt with domain URL
> 
> A packaged app will show the base URL of the domain from which the app is
> being installed.

Ah okay. Looks good then for the packaged app side. Thanks for checking.
Comment 11 Mark Finkle (:mfinkle) (use needinfo?) 2013-04-09 20:23:52 PDT
Comment on attachment 735316 [details] [diff] [review]
Adding app origin to install dialog

Looks good.
Comment 12 Martyn Haigh (:mhaigh) 2013-04-11 12:47:37 PDT
checkin-needed
Comment 13 Ryan VanderMeulen [:RyanVM] 2013-04-11 15:09:27 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/783f66376d65
Comment 14 Ryan VanderMeulen [:RyanVM] 2013-04-12 05:12:44 PDT
https://hg.mozilla.org/mozilla-central/rev/783f66376d65

Note You need to log in before you can comment on or make changes to this bug.