993845 - Move event handling for SeaMonkey's aboutSessionRestore.xhtml page into aboutSessionRestore.js

Status: RESOLVED FIXED

(SeaMonkey :: Session Restore, defect)

Description

[rsx11m]

+++ This bug was initially created as a clone of Bug #960566 +++

> With the current plan to harden the security of Firefox, we want to
> disallow internal privileged pages to use inline JavaScript.

The "about:sessionrestore" page is a privileged page and has some inline JavaScript for onxxx="..." events in the XHTML code for trees and buttons.

There is also an <input type="text" id="sessionData" style="display: none;"/> element which may be rewritten as <input type="hidden" ...> rather.

In contrast to the previously handled pages this one has aboutSessionRestore.js already.

Comment 1

[rsx11m]

Attachment: Proposed patch

This should be the last one for now in this series (and an easy one), the others will need some more thinking or additional work.

Moving the event handlers into window.onload is straight-forward here, I've verified that clicks and keys still work in the tree view and for the buttons.

I've also changed <input type="text" style="display: none;"/> to <input type="hidden"/> which is closer to the intentions of the specs and conveniently avoids the inline style (where "hidden" corresponds to a "text" string, thus the type hasn't changed in practical terms).

Comment 2

[rsx11m]

On a side note, type="hidden" was suggested by you in bug 459550 comment #11 already, but not responded to, thus a late follow-up here (and it seems to work equally fine, whatever the original reason was).

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/comm-central/rev/da2a1fab3f66