825686 - Permission restrictions for apps should also be enforced for non-app content

Status: RESOLVED DUPLICATE of bug 823974

(Core :: DOM: Device Interfaces, defect)

Description

[Lucas Adamski [:ladamski]]

Per bug 823974#c5 we should enforce the same permissions restrictions for embedded non-app content as for the app that embeds it.  

Which means that if an app does not have the geolocation permission in its manifest, then any content that embeds should not be able to prompt for geolocation either.  

Conversely, if the app does contain the geolocation permission in this manifest then any combination of the app and/or the content it embeds can ask the user for permission to use geolocation (i.e. the app does not have to be granted geolocation access before embedded content is allowed to request it).

I believe this really would only immediately impact 3 existing permissions per https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0Akyz_Bqjgf5pdENVekxYRjBTX0dCXzItMnRyUU1RQ0E#gid=0:
- desktop-notification
- fmradio
- geolocation

bb+ per triage conversations due to app breakage risk of implementing this further down the road.

Comment 1

[Doug Turner (:dougt)]

the work required is really covered by 823974.