896211 - browser.mixedcontent.warning.infoURL should use SSL

Status: VERIFIED FIXED

(Firefox :: Security, defect)

Description

[sjw]

The value of browser.mixedcontent.warning.infoURL (Learn More) is http://support.mozilla.org/1/%APP%/%VERSION%/%OS%/%LOCALE%/mixed-content/

It should be https://support.mozilla.org/1/%APP%/%VERSION%/%OS%/%LOCALE%/mixed-content/ (Use https)

Comment 1

[Ekanan Ketunuti]

Attachment: patch

Comment 2

[sjw]

Comment on attachment 778937 [details] [diff] [review]
patch

Wow, thats fast :)

> pref("browser.geolocation.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/geolocation/");
For what is this Line?

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 778937 [details] [diff] [review]
patch

This looks good, but this link should really be relative to app.support.baseURL, rather than in its own pref. Do you want to fix that instead?

Comment 4

[Ekanan Ketunuti]

Attachment: patch, v2

Comment 5

[Jared Wein [:jaws] (please needinfo? me)]

I think this patch should use openHelpLink though I haven't tested it.

Comment 6

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 779019 [details] [diff] [review]
patch, v2

(In reply to Jared Wein [:jaws] (Vacation 8/1 to 8/4) from comment #5)
> I think this patch should use openHelpLink though I haven't tested it.

There are a number of places where we don't use openHelpLink - and it's usually for stuff like this (dynamically populated / initted UI). I think we're OK to still do this - but feel free to file a follow-up bug if you think this is a real issue.

Anyhow, this patch looks good to me. Thanks Ekanan!

Comment 7

[:Gavin Sharp [email: [e-mail]]]

(In reply to Mike Conley (:mconley) from comment #6)
> There are a number of places where we don't use openHelpLink - and it's
> usually for stuff like this (dynamically populated / initted UI)

We should be able to just set the onclick attribute on the link, rather than setting href?

I.e. helplink.setAttribute("onclick", "openHelpLink('mixed-content');"); or somesuch

Comment 8

[Mike Conley (:mconley) (:⚙️)]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #7)
> (In reply to Mike Conley (:mconley) from comment #6)
> > There are a number of places where we don't use openHelpLink - and it's
> > usually for stuff like this (dynamically populated / initted UI)
> 
> We should be able to just set the onclick attribute on the link, rather than
> setting href?
> 
> I.e. helplink.setAttribute("onclick", "openHelpLink('mixed-content');"); or
> somesuch

Yeah, I'd be fine with that too. Either that, or blanket conversion of all such instances in a separate bug (since this bug was just about switching the link to HTTPS).

Ekanan - how do you feel about spinning up a new patch with Gavin's suggestion?

Comment 9

[Ekanan Ketunuti]

Attachment: patch, v3

Updated the patch to use openHelpLink.

Comment 10

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 785297 [details] [diff] [review]
patch, v3

Review of attachment 785297 [details] [diff] [review]:
-----------------------------------------------------------------

So sorry for the delay! This looks good to me.

Comment 11

[Ekanan Ketunuti]

Attachment: unbitrotted c8c9bd74cc40

carrying over r=mconley

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/fx-team/rev/cf667c298f00

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cf667c298f00

Comment 14

[Mihai Morar, (:MihaiMorar)]

I confirm the fix is verified on Latest Nightly 26. 

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0

browser.geolocation.warning.infoURL pref is using https as mentioned in Comment 0.

https://www.mozilla.org/%LOCALE%/firefox/geolocation/