989777 - Move inline scripts for SeaMonkey's aboutPrivateBrowsing.xul page into a separate file

Status: RESOLVED FIXED

(SeaMonkey :: General, defect)

Description

[rsx11m]

+++ This bug was initially created as a clone of Bug #960566 +++

> With the current plan to harden the security of Firefox, we want to
> disallow internal privileged pages to use inline JavaScript.

The "about:privatebrowsing" page is a privileged page and has some inline JavaScript for onLoad() in the XUL code. There are also three buttons in this page (i.e., privatebrowsingpage.learnmore, privatebrowsingpage.close, and privatebrowsingpage.private), which have "oncommand=" attributes that need to be translated into event handlers to get rid of the inline scripts.

Comment 1

[rsx11m]

Attachment: Proposed patch

This patch moves the contents of onLoad() into a "DOMContentLoaded" event listener that also adds three "command" event listeners for the buttons.

The onLoad() JavaScript code itself hasn't changed from the previous version.
As a (necessary) secondary fix, all buttons now also have proper ids.

Having seen similar definitions with and without the (event) argument in the function argument, I'm not sure where it's necessary and where it is redundant. Also, the optional useCapture defaults to false which seems to be fine here.

Comment 2

[[e-mail]]

Comment on attachment 8403702 [details] [diff] [review]
Proposed patch

Seems reasonable but can you use window.onload like you did in the other bug?

Also you can use double quotes in the .js file (obviously single quotes are preferred in event handler attributes).

(You don't need the event parameter if as here you don't use it.)

Comment 3

[rsx11m]

Attachment: Proposed patch (v2)

(In reply to [e-mail] from comment #2)
> Seems reasonable but can you use window.onload like you did in the other bug?

I've seen window.onload being used with XHTML pages only and the more complicated form with XUL, thus I assumed that it wouldn't work here - yet it does, hence so changed.

> Also you can use double quotes in the .js file (obviously single quotes are
> preferred in event handler attributes).

Quotes flipped to preferred style.

> (You don't need the event parameter if as here you don't use it.)

Function arguments removed.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/comm-central/rev/80a530af380d