86081 - Update configurable policies documentation

Status: VERIFIED DUPLICATE of bug 81467

(Core :: Security: CAPS, defect)

Description

[Jubal Kessler]

Adding "allow some, deny all" logic for popupsites capability would really be
useful. I would like to trust only a few sites to display popups without
spamming my screen, while blocking all non-trusted sites.

This is the reverse of current capability.policy.popupsites.Window.open logic,
in which some evil sites can be blocked from executing popups, but all others
(including as-yet-unvisited evil popup sites) are let through.

In other words, this would be proactive rather than reactive behavior. If you
have "deny some, allow all" logic, and "deny all" logic, it'd make sense to add
"allow some, deny all" as well.

Thanks,

Jubal

Comment 1

[André Schild]

Should have priority Enhancement request.

Comment 2

[Boris Zbarsky [:bzbarsky]]

You can currently do this -- you can disable popups for all sites and then
enable popups for a select group of sites:

user_pref("capability.policy.default.windowinternal.open","noAccess");
user_pref("capability.policy.popupsites.windowinternal.open","_____");

where the blank needs to be filled in appropriately and popupsites needs to be
defined appropriately.

Over to security:caps in case Mitch has anything else to add.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Boris is correct, excpet the syntax has changed slightly: 
user_pref("capability.policy.default.Window.open","noAccess");
user_pref("capability.policy.popupsites.sites","<your site list>");
user_pref("capability.policy.popupsites.Window.open","allAccess");

Note that windowinternal.open has changed to Window.open.

Comment 4

[Jubal Kessler]

Very cool, thanks for the clarification. This ought to make it into the
documentation as a scenario, for instance a paragraph describing the effects of
setting the popup preferences for the following scenarios:

1. "allow all, deny some"
2. "deny all, allow some"
3. "deny all"

Thanks,

Jubal

Comment 5

[Boris Zbarsky [:bzbarsky]]

Please file a bug in Secutity:CAPS on [e-mail], add the relnote
keyword, and reference this bug.  We should relnote the syntax change anyway.

Then post the new bug number here.  :)

Comment 6

[Jubal Kessler]

created new bug requesting relnote stuff for capability.policy as per this bug.

Added [e-mail] to cc: list for that bug.

http://bugzilla.mozilla.org/show_bug.cgi?id=86260

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Reopening to track needed documentation changes.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

->Jesse

Comment 9

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 81467 ***

Comment 10

[ckritzer (gone)]

Marking VERIFIED DUPLICATE.