947129 - There should be a way to change implicit permissions in the Permissions API

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Frederik Braun [:freddy] (OOO - back August 10th)]

According to <https://developer.mozilla.org/en-US/docs/WebAPI/Permissions#Setting_permission>, you cannot disallow implicit permissions (like tcpsocket or systemxhr), but I can imagine that some power-users would fancy that. This could surely be useful for debugging too.

I think this could be fixed by making isExplicit() just return "false" all the time if a certain pref is set..
Code in: <http://mxr.mozilla.org/mozilla-central/source/dom/permission/PermissionSettings.js#71>

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Rather than changing gecko to make it lie about a permission, it would be better just to make an seperate "permission manager app" to manage permissions. IE just clone the settings app section which manages permission, and change the logic to display all permissions.

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Or I am missing the point about set refusing to set implicit permissions ;) But yeh, this was done for a reason, so we would need consensus on taking away this control. (and a way to mitigate the risk of doing so...)

Comment 3

[Frederik Braun [:freddy] (OOO - back August 10th)]

Closing this: A wider set of permissions will be exposed for developers (and power users who know their way around) through bug 1049371. There is an independent permission app which allows revoking a wider set of permissions here: https://github.com/mozfreddyb/permissions-app