February 2015 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-31.4.0esr-4.5-1] Bug 13900: Remove 3rd party HTTP auth tokens.
by mikeperry＠torproject.org 12 Feb '15

12 Feb '15

commit b6be541aaa22422ecf9e70680282aa9c7dc05f06 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Feb 4 10:38:44 2015 -0500 Bug 13900: Remove 3rd party HTTP auth tokens. Prevent user tracking via HTTP Basic Authentication by removing Authorization headers from third party requests. This is a port of a piece of the Stanford SafeCache code that previously was included in Torbutton. --- content/base/src/ThirdPartyUtil.cpp | 21 ++++++--- netwerk/base/public/mozIThirdPartyUtil.idl | 22 ++++++++- netwerk/protocol/http/nsHttpChannel.cpp | 70 ++++++++++++++++++++++++++++ netwerk/protocol/http/nsHttpChannel.h | 1 + 4 files changed, 107 insertions(+), 7 deletions(-) diff --git a/content/base/src/ThirdPartyUtil.cpp b/content/base/src/ThirdPartyUtil.cpp index e2287eb..695392f 100644 --- a/content/base/src/ThirdPartyUtil.cpp +++ b/content/base/src/ThirdPartyUtil.cpp @@ -412,20 +412,28 @@ ThirdPartyUtil::GetBaseDomain(nsIURI* aHostURI, return NS_OK; } -// Returns true if First Party Isolation is currently active for the given nsIChannel. -// Depends on Preference setting and possibly the state of Private Browsing mode. -bool ThirdPartyUtil::IsFirstPartyIsolationActive(nsIChannel *aChannel, nsIDocument *aDoc) +// Determine if First Party Isolation is currently active for the given +// nsIChannel or nsIDocument. Depends on preference setting and +// possibly the state of Private Browsing mode. +NS_IMETHODIMP +ThirdPartyUtil::IsFirstPartyIsolationActive(nsIChannel *aChannel, + nsIDocument *aDoc, + bool* aResult) { + NS_ASSERTION(aResult, "null outparam pointer"); + int32_t isolationState = mozilla::Preferences::GetInt("privacy.thirdparty.isolate"); if (isolationState == 1) { if (!aChannel && aDoc) { // No channel passed directly. Can we get a channel from aDoc? aChannel = aDoc->GetChannel(); } - return aChannel && NS_UsePrivateBrowsing(aChannel); + *aResult = aChannel && NS_UsePrivateBrowsing(aChannel); } else { // (isolationState == 0) || (isolationState == 2) - return (isolationState == 2); + *aResult = (isolationState == 2); } + + return NS_OK; } // Produces a URI that uniquely identifies the first party to which @@ -435,7 +443,8 @@ bool ThirdPartyUtil::IsFirstPartyIsolationActive(nsIChannel *aChannel, nsIDocume NS_IMETHODIMP ThirdPartyUtil::GetFirstPartyIsolationURI(nsIChannel *aChannel, nsIDocument *aDoc, nsIURI **aOutput) { - bool isolationActive = IsFirstPartyIsolationActive(aChannel, aDoc); + bool isolationActive = false; + (void)IsFirstPartyIsolationActive(aChannel, aDoc, &isolationActive); if (isolationActive) { return GetFirstPartyURI(aChannel, aDoc, aOutput); } else { diff --git a/netwerk/base/public/mozIThirdPartyUtil.idl b/netwerk/base/public/mozIThirdPartyUtil.idl index 87fb630..0bb632b 100644 --- a/netwerk/base/public/mozIThirdPartyUtil.idl +++ b/netwerk/base/public/mozIThirdPartyUtil.idl @@ -13,7 +13,7 @@ interface nsIDocument; * Utility functions for determining whether a given URI, channel, or window * hierarchy is third party with respect to a known URI. */ -[scriptable, uuid(d994fd1d-d2fe-4372-9ae7-88b08b7d9d90)] +[scriptable, uuid(b538074d-5e00-40b3-b5c4-e060ae010b83)] interface mozIThirdPartyUtil : nsISupports { /** @@ -165,6 +165,26 @@ interface mozIThirdPartyUtil : nsISupports in nsIDocument aDoc); /** + * isFirstPartyIsolationActive + * + * Determine if First Party Isolation is currently active for the given + * nsIChannel or nsIDocument. Depends on preference setting and + * possibly the state of Private Browsing mode. + * + * @param aChannel + * An arbitrary channel for some content element of a first party + * load. Can be null. + * + * @param aDoc + * An arbitrary third party document. Can be null. + * + * @return true if first party isolation is active. + */ + + [noscript] bool isFirstPartyIsolationActive(in nsIChannel aChannel, + in nsIDocument aDoc); + + /** * getFirstPartyIsolationURI * * If first-party isolation is active, then diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index b37b60b..59ba71b 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -4600,6 +4600,8 @@ nsHttpChannel::BeginConnect() // notify "http-on-modify-request" observers CallOnModifyRequestObservers(); + RemoveAuthorizationHeaderIfAppropriate(); + // Check to see if we should redirect this channel elsewhere by // nsIHttpChannel.redirectTo API request if (mAPIRedirectToURI) { @@ -5750,6 +5752,72 @@ nsHttpChannel::ResumeAt(uint64_t aStartPos, return NS_OK; } +// Remove the Authorization header if first party isolation is active and +// this channel is processing a third party request. This prevents user +// tracking via HTTP Basic Authentication. +// Note that this approach disables authentication for 3rd party domains. It +// would be better if we could isolate the authentication while still allowing +// it to be transmitted... but HTTP authentication is rarely used anyway. +void +nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() +{ + if (!mRequestHead.PeekHeader(nsHttp::Authorization)) { + return; // No Authorization header is present. + } + + nsCOMPtr<mozIThirdPartyUtil> thirdPartySvc + = do_GetService(THIRDPARTYUTIL_CONTRACTID); + bool isolationActive = true; + (void)thirdPartySvc->IsFirstPartyIsolationActive(this, nullptr, + &isolationActive); + if (!isolationActive) + return; // First party isolation is disabled for this channel. + + bool isAuthAllowed = false; + nsCOMPtr<nsIURI> firstPartyURI; + nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, + getter_AddRefs(firstPartyURI)); + if (NS_SUCCEEDED(rv) && firstPartyURI) { + isAuthAllowed = (mURI == firstPartyURI) + || HostPartIsTheSame(firstPartyURI); + } else { + // We failed to get the first party URI. Check the document URI so + // that we can allow authentication if the request originates from the + // the browser chrome, e.g., some favicon requests. If there is no + // document URI associated with this request, it cannot be associated + // with a content document, so it must be a special request (e.g., + // favicon fetch or OSCP), for which we also allow authenication. + nsCOMPtr<nsIURI> docURI; + rv = GetDocumentURI(getter_AddRefs(docURI)); + if (NS_FAILED(rv) || !docURI) { + isAuthAllowed = true; + } else { + nsAutoCString docURISpec; + docURI->GetAsciiSpec(docURISpec); + if (docURISpec == "chrome://browser/content/browser.xul") + isAuthAllowed = true; + } + } + + if (!isAuthAllowed) { + mRequestHead.ClearHeader(nsHttp::Authorization); + mRequestHead.ClearHeader(nsHttp::Cache_Control); + mRequestHead.ClearHeader(nsHttp::Pragma); + +#ifdef PR_LOGGING + nsAutoCString requestURIStr, firstPartyURIStr; + mURI->GetAsciiSpec(requestURIStr); + if (firstPartyURI) + firstPartyURI->GetAsciiSpec(firstPartyURIStr); + else + firstPartyURIStr = "--N/A--"; + LOG(("Removed Authorization header from third party request" + " [Request URI=%s, First Party URI=%s]\n", + requestURIStr.get(), firstPartyURIStr.get())); +#endif + } +} + nsresult nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) { @@ -5771,6 +5839,8 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) // notify "http-on-modify-request" observers CallOnModifyRequestObservers(); + RemoveAuthorizationHeaderIfAppropriate(); + mIsPending = true; // get rid of the old response headers diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h index 8d3d23d..a76ed8e 100644 --- a/netwerk/protocol/http/nsHttpChannel.h +++ b/netwerk/protocol/http/nsHttpChannel.h @@ -282,6 +282,7 @@ private: nsresult ProcessPartialContent(); nsresult OnDoneReadingPartialCacheEntry(bool *streamDone); + void RemoveAuthorizationHeaderIfAppropriate(); nsresult DoAuthRetry(nsAHttpConnection *); void HandleAsyncRedirectChannelToHttps();

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] Bug 10280: Don't load any plugins into the address space.
by mikeperry＠torproject.org 12 Feb '15

12 Feb '15

commit bc305e697edb6860fe035e4b67fc5f027de237a5 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Feb 12 16:04:13 2015 -0800 Bug 10280: Don't load any plugins into the address space. If the pref "plugin.disable" is set, the user has to click an extra button to cause Firefox to actually scan the filesystem for plugins. Note: The strings for this patch are actually present in Torbutton. Patch by bobnomnom. --- dom/plugins/base/nsPluginHost.cpp | 11 +++ toolkit/mozapps/extensions/content/extensions.js | 75 +++++++++++++++++++- toolkit/mozapps/extensions/content/extensions.xul | 23 ++++++ .../mozapps/extensions/internal/PluginProvider.jsm | 11 +++ 4 files changed, 117 insertions(+), 3 deletions(-) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp index 1efe59f..68ac197 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp @@ -3105,6 +3105,7 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, sInst->Release(); } if (!strcmp(NS_PREFBRANCH_PREFCHANGE_TOPIC_ID, aTopic)) { + NS_ConvertUTF16toUTF8 prefName(someData); mPluginsDisabled = Preferences::GetBool("plugin.disable", false); mPluginsClickToPlay = Preferences::GetBool("plugins.click_to_play", false); // Unload or load plugins as needed @@ -3113,6 +3114,16 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, } else { LoadPlugins(); } + if (prefName.Equals("plugin.disable")) { + nsCOMPtr<nsIObserverService> obsService = + mozilla::services::GetObserverService(); + if (obsService) { + nsAutoString pluginPolicy; + pluginPolicy = mPluginsDisabled ? NS_LITERAL_STRING("disabled") + : NS_LITERAL_STRING("enabled"); + obsService->NotifyObservers(nullptr, "plugins-policy-changed", pluginPolicy.get()); + } + } } if (!strcmp("blocklist-updated", aTopic)) { nsPluginTag* plugin = mPlugins; diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js index 35d2392..6790841 100644 --- a/toolkit/mozapps/extensions/content/extensions.js +++ b/toolkit/mozapps/extensions/content/extensions.js @@ -858,6 +858,20 @@ var gViewController = { } }, + cmd_goToEnablePlugins: { + isEnabled: function cmd_goToEnablePlugins_isEnabled() true, + doCommand: function cmd_goToEnablePlugins_doCommand() { + Services.prefs.setBoolPref("plugin.disable", false); + } + }, + + cmd_goToDisablePlugins: { + isEnabled: function cmd_goToDisablePlugins_isEnabled() true, + doCommand: function cmd_goToDisablePlugins_doCommand() { + Services.prefs.setBoolPref("plugin.disable", true); + } + }, + cmd_goToRecentUpdates: { isEnabled: function cmd_goToRecentUpdates_isEnabled() true, doCommand: function cmd_goToRecentUpdates_doCommand() { @@ -2553,12 +2567,17 @@ var gListView = { node: null, _listBox: null, _emptyNotice: null, + _pluginDisabledNotice: null, + _pluginEnabledNotice: null, _type: null, + _pluginListEmpty: false, initialize: function gListView_initialize() { this.node = document.getElementById("list-view"); this._listBox = document.getElementById("addon-list"); this._emptyNotice = document.getElementById("addon-list-empty"); + this._pluginDisabledNotice = document.getElementById("plugin-disabled"); + this._pluginEnabledNotice = document.getElementById("plugin-enabled"); var self = this; this._listBox.addEventListener("keydown", function listbox_onKeydown(aEvent) { @@ -2570,6 +2589,10 @@ var gListView = { }, false); }, + shutdown: function gListView_shutdown() { + AddonManager.removeAddonListener(this); + }, + show: function gListView_show(aType, aRequest) { if (!(aType in AddonManager.addonTypes)) throw Components.Exception("Attempting to show unknown type " + aType, Cr.NS_ERROR_INVALID_ARG); @@ -2577,9 +2600,12 @@ var gListView = { this._type = aType; this.node.setAttribute("type", aType); this.showEmptyNotice(false); + this.showPluginEnabledNotice(false); + this.showPluginDisabledNotice(false); while (this._listBox.itemCount > 0) this._listBox.removeItemAt(0); + this._pluginListEmpty = true; var self = this; getAddonsAndInstalls(aType, function show_getAddonsAndInstalls(aAddonsList, aInstallsList) { @@ -2594,20 +2620,22 @@ var gListView = { for (let installItem of aInstallsList) elements.push(createItem(installItem, true)); - self.showEmptyNotice(elements.length == 0); if (elements.length > 0) { sortElements(elements, ["uiState", "name"], true); for (let element of elements) self._listBox.appendChild(element); } + self.showAllNeedNotices(true); gEventManager.registerInstallListener(self); gViewController.updateCommands(); gViewController.notifyViewChanged(); + AddonManager.addAddonListener(self); }); }, hide: function gListView_hide() { + AddonManager.removeAddonListener(this); gEventManager.unregisterInstallListener(this); doPendingUninstalls(this._listBox); }, @@ -2616,6 +2644,43 @@ var gListView = { this._emptyNotice.hidden = !aShow; }, + showPluginDisabledNotice: function gListView_showPluginDisabledNotice(aShow) { + this._pluginDisabledNotice.hidden = !aShow; + }, + + showPluginEnabledNotice: function gListView_showPluginEnabledNotice(aShow) { + this._pluginEnabledNotice.hidden = !aShow; + }, + + showAllNeedNotices: function gListView_showAllNeedNotices(aShow) { + var empty_list = (this._listBox.itemCount == 0); + var show_empty_notice = true; + + if (this._type == "plugin") { + var update_notices = (this._pluginListEmpty != empty_list); + this._pluginListEmpty = empty_list; + + if (update_notices || aShow) { + var plugin_disable = false; + + try { + plugin_disable = Services.prefs.getBoolPref("plugin.disable") + } catch (e) {} + + if (plugin_disable == true) { + this.showPluginEnabledNotice(false); + this.showPluginDisabledNotice(true); + show_empty_notice = false; + } else { + this.showPluginDisabledNotice(false); + this.showPluginEnabledNotice(true); + } + } + } + if (show_empty_notice == true) + this.showEmptyNotice(empty_list); + }, + onSortChanged: function gListView_onSortChanged(aSortBy, aAscending) { sortList(this._listBox, aSortBy, aAscending); }, @@ -2658,6 +2723,10 @@ var gListView = { } }, + onUninstalled: function gListView_onUninstalled() { + this.showAllNeedNotices(false); + }, + addItem: function gListView_addItem(aObj, aIsInstall) { if (aObj.type != this._type) return; @@ -2673,7 +2742,7 @@ var gListView = { let item = createItem(aObj, aIsInstall); this._listBox.insertBefore(item, this._listBox.firstChild); - this.showEmptyNotice(false); + this.showAllNeedNotices(false); }, removeItem: function gListView_removeItem(aObj, aIsInstall) { @@ -2682,7 +2751,7 @@ var gListView = { for (let item of this._listBox.childNodes) { if (item[prop] == aObj) { this._listBox.removeChild(item); - this.showEmptyNotice(this._listBox.itemCount == 0); + this.showAllNeedNotices(false); return; } } diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul index d247bdf..1c2bb07 100644 --- a/toolkit/mozapps/extensions/content/extensions.xul +++ b/toolkit/mozapps/extensions/content/extensions.xul @@ -79,6 +79,8 @@ <command id="cmd_findAllUpdates"/> <command id="cmd_restartApp"/> <command id="cmd_goToDiscoverPane"/> + <command id="cmd_goToEnablePlugins"/> + <command id="cmd_goToDisablePlugins"/> <command id="cmd_goToRecentUpdates"/> <command id="cmd_goToAvailableUpdates"/> <command id="cmd_installFromFile"/> @@ -386,7 +388,28 @@ </vbox> <spacer class="alert-spacer-after"/> </vbox> + <vbox id="plugin-disabled" class="alert-container" + flex="1" hidden="true"> + <spacer class="alert-spacer-before"/> + <vbox class="alert"> + <label value="&plugins.installed.find;"/> + <button class="button-enableplugin" + label="&plugins.installed.enable;" + command="cmd_goToEnablePlugins"/> + </vbox> + <spacer class="alert-spacer-after"/> + </vbox> <richlistbox id="addon-list" class="list" flex="1"/> + <vbox id="plugin-enabled" class="view-header global-info-container" + hidden="true"> + <vbox class="global-info" flex="1" align="center"> + <button class="button-disableplugin" + label="&plugins.installed.disable;" + tooltiptext="&plugins.installed.disable.tip;" + command="cmd_goToDisablePlugins"/> + <spacer flex="5000"/>  + </vbox> + </vbox> </vbox>  diff --git a/toolkit/mozapps/extensions/internal/PluginProvider.jsm b/toolkit/mozapps/extensions/internal/PluginProvider.jsm index 7b6e335..2cf2583 100644 --- a/toolkit/mozapps/extensions/internal/PluginProvider.jsm +++ b/toolkit/mozapps/extensions/internal/PluginProvider.jsm @@ -52,6 +52,7 @@ var PluginProvider = { plugins: null, startup: function PL_startup() { + Services.obs.addObserver(this, "plugins-policy-changed", false); Services.obs.addObserver(this, LIST_UPDATED_TOPIC, false); Services.obs.addObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED, false); }, @@ -64,6 +65,7 @@ var PluginProvider = { this.plugins = null; Services.obs.removeObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED); Services.obs.removeObserver(this, LIST_UPDATED_TOPIC); + Services.obs.removeObserver(this, "plugins-policy-changed"); }, observe: function(aSubject, aTopic, aData) { @@ -89,6 +91,15 @@ var PluginProvider = { if (this.plugins) this.updatePluginList(); break; + case "plugins-policy-changed": + var plugin_policy = aData + if (!this.plugins) + this.plugins =[]; + this.updatePluginList(); + Services.obs.notifyObservers(null, + "plugin-provider-after-changed-policy", + plugin_policy); + break; } },

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] fixup! Omnibox: Add disconnect, youtube; remove Amazon and eBay
by mikeperry＠torproject.org 12 Feb '15

12 Feb '15

commit 1620c8e09d3ebc57066d6ada566d5e119b8512aa Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Feb 12 16:52:12 2015 -0800 fixup! Omnibox: Add disconnect, youtube; remove Amazon and eBay Sadly, having our search box say "Disconnect" is not very usable. --- browser/locales/en-US/searchplugins/disconnect.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/locales/en-US/searchplugins/disconnect.xml b/browser/locales/en-US/searchplugins/disconnect.xml index 40c512f..5b80262 100644 --- a/browser/locales/en-US/searchplugins/disconnect.xml +++ b/browser/locales/en-US/searchplugins/disconnect.xml @@ -1,6 +1,6 @@ <?xml version="1.0" encoding="UTF-8"?> <OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"> - <ShortName>Disconnect</ShortName> + <ShortName>Search</ShortName> <LongName>Disconnect Private Search</LongName> <Description>Private searches using disconnect.me</Description> <Url type="text/html" method="POST" template="https://search.disconnect.me/searchTerms/search?ses=Google&location_opt…">

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] fixup! Bug 14490: Make Disconnect the default search engine
by mikeperry＠torproject.org 12 Feb '15

12 Feb '15

commit 218316907ad4fb5662741bb541265ac59c7b5f9f Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Feb 12 16:53:23 2015 -0800 fixup! Bug 14490: Make Disconnect the default search engine Sadly, our search box sould not say "Disconnect". --- browser/app/profile/000-tor-browser.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 0d5faa6..cb59517 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,14 +150,14 @@ pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\" // Putting the search engine prefs into this file to fix #11236. // Default search engine -pref("browser.search.defaultenginename", "Disconnect"); +pref("browser.search.defaultenginename", "Search"); // Search engine order (order displayed in the search bar dropdown) // Somewhat surprisingly we get Disconnect - YouTube - Twitter as the order // only if we set them as below. pref("browser.search.order.extra.1", "YouTube"); pref("browser.search.order.extra.2", "Twitter"); -pref("browser.search.order.extra.3", "Disconnect"); +pref("browser.search.order.extra.3", "Search"); // Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW? // Nvida cards also experience crashes without the second pref set to disabled

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] Merge remote-tracking branch 'brade/bug13900-01' into tor-browser-31.4.0esr-4.5-1
by mikeperry＠torproject.org 12 Feb '15

12 Feb '15

commit feb32165494be68c1d29a48ef9d4d9cf8b0b36ed Merge: 2183169 b6be541 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Feb 12 18:01:12 2015 -0800 Merge remote-tracking branch 'brade/bug13900-01' into tor-browser-31.4.0esr-4.5-1 content/base/src/ThirdPartyUtil.cpp | 21 ++++++--- netwerk/base/public/mozIThirdPartyUtil.idl | 22 ++++++++- netwerk/protocol/http/nsHttpChannel.cpp | 70 ++++++++++++++++++++++++++++ netwerk/protocol/http/nsHttpChannel.h | 1 + 4 files changed, 107 insertions(+), 7 deletions(-)

1 0

[torbutton/master] fixup! Bug 9387: Bind jar: pref to security slider
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit 1e727db8e063928d48d1bfbcdedd7bc7f64295f1 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Feb 11 16:54:29 2015 -0800 fixup! Bug 9387: Bind jar: pref to security slider Fix a missing :. --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 752206e..2fa7189 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2161,7 +2161,7 @@ var torbutton_sec_ml_bool_prefs = { "javascript.options.asmjs" : false, "noscript.forbidMedia" : true, "media.webaudio.enabled" : false, - "network.jar.block-remote-files", true, + "network.jar.block-remote-files" : true, // XXX: pref for disabling MathML is missing };

1 0

[torbutton/master] Bug 11236: Don't set search engines in extension
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit 4c35e375ff74614b84ff722e9214d757fed07b01 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 23 12:09:45 2015 +0000 Bug 11236: Don't set search engines in extension We risk search engine names getting translated which results in broken search boxes if we expose them in locale files. As we only use en-US search engines (i.e. no localized ones) we can avoid that risk by removing these language strings and adding the search engines names directly into a central preference file shared by all localized bundles. --- src/chrome/locale/en/browser.properties | 8 -------- src/defaults/preferences/preferences.js | 6 +----- 2 files changed, 1 insertion(+), 13 deletions(-) diff --git a/src/chrome/locale/en/browser.properties b/src/chrome/locale/en/browser.properties index 295a03a..8849b67 100644 --- a/src/chrome/locale/en/browser.properties +++ b/src/chrome/locale/en/browser.properties @@ -3,11 +3,3 @@ browser.startup.homepage=about:tor # Spell checker dictionary spellchecker.dictionary=en_US - -# Default search engine -browser.search.defaultenginename=Startpage - -# Search engine order (order displayed in the search bar dropdown) -browser.search.order.1=Startpage -browser.search.order.2=DuckDuckGo -browser.search.order.3=Google diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 3e02b77..c6fb8e4 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -225,10 +225,6 @@ pref("extensions.torbutton.cookie_js_allow", true); pref("extensions.torbutton.prompt_torbrowser", true); pref("extensions.torbutton.confirm_plugins", true); -// Browser home page, spell checker dictionary, and search engine overrides: +// Browser home page, and spell checker dictionary: pref("browser.startup.homepage", "chrome://torbutton/locale/browser.properties"); pref("spellchecker.dictionary", "chrome://torbutton/locale/browser.properties"); -pref("browser.search.defaultenginename", "chrome://torbutton/locale/browser.properties"); -pref("browser.search.order.1", "chrome://torbutton/locale/browser.properties"); -pref("browser.search.order.2", "chrome://torbutton/locale/browser.properties"); -pref("browser.search.order.3", "chrome://torbutton/locale/browser.properties");

1 0

[torbutton/master] Bug 14392: Make about:tor behave like other initial pages.
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit 4d194b2b827b65f357f6c0a9e02ac719bad86afc Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Feb 11 16:46:10 2015 -0800 Bug 14392: Make about:tor behave like other initial pages. In particular: Don't steal focus from the URL bar. --- src/chrome/content/aboutTor/aboutTor.xhtml | 1 - 1 file changed, 1 deletion(-) diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/src/chrome/content/aboutTor/aboutTor.xhtml index c13f60e..9b77af2 100644 --- a/src/chrome/content/aboutTor/aboutTor.xhtml +++ b/src/chrome/content/aboutTor/aboutTor.xhtml @@ -33,7 +33,6 @@ function onLoad() window.setTimeout( function() { adjustToolbarIconArrow(); - document.getElementById('sx').focus(); }, 0); }

1 0

[torbutton/master] Bug 14490: Make disconnect search the default search engine.
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit 699f82654904841df2691fe020928933afe312ff Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Feb 11 16:57:08 2015 -0800 Bug 14490: Make disconnect search the default search engine. --- src/chrome/content/aboutTor/aboutTor.xhtml | 8 ++++---- src/chrome/locale/en/aboutTor.dtd | 1 + src/chrome/locale/en/aboutTor.properties | 6 ++++++ 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/src/chrome/content/aboutTor/aboutTor.xhtml index 9b77af2..95807fd 100644 --- a/src/chrome/content/aboutTor/aboutTor.xhtml +++ b/src/chrome/content/aboutTor/aboutTor.xhtml @@ -112,9 +112,9 @@ function insertPropertyStrings() Components.utils.import("resource://gre/modules/Services.jsm"); var gStringBundle = Services.strings.createBundle(kPropertiesURL); - var s1 = gStringBundle.GetStringFromName("aboutTor.searchSP.privacy.link"); - var s2 = gStringBundle.GetStringFromName("aboutTor.searchSP.search.link"); - var result = gStringBundle.formatStringFromName("aboutTor.searchSP.privacy", + var s1 = gStringBundle.GetStringFromName("aboutTor.searchDC.privacy.link"); + var s2 = gStringBundle.GetStringFromName("aboutTor.searchDC.search.link"); + var result = gStringBundle.formatStringFromName("aboutTor.searchDC.privacy", [s1, s2], 2); if (result) { var elem = document.getElementById("searchProviderInfo"); @@ -165,7 +165,7 @@ window.addEventListener("pageshow", function() { </div> <div class="searchbox hideIfTorOff">  - <form action="&aboutTor.searchSPPost.link;" method="post"> + <form action="&aboutTor.searchDCPost.link;" method="post"> <div id="sxw"> <div id="sbutton"> <input name="b" id="sb" value="" title="&aboutTor.search.label;" diff --git a/src/chrome/locale/en/aboutTor.dtd b/src/chrome/locale/en/aboutTor.dtd index 6f63ff7..771f8ae 100644 --- a/src/chrome/locale/en/aboutTor.dtd +++ b/src/chrome/locale/en/aboutTor.dtd @@ -25,6 +25,7 @@ <!ENTITY aboutTor.searchSPPost.link "https://startpage.com/rth/search"> <!ENTITY aboutTor.searchDDGPost.link "https://duckduckgo.com/html/"> +<!ENTITY aboutTor.searchDCPost.link "https://search.disconnect.me/searchTerms/search?ses=Google&location_opt…"> <!ENTITY aboutTor.torInfo1.label "Additional Info:"> <!ENTITY aboutTor.torInfo2.label "Country & IP Address:"> diff --git a/src/chrome/locale/en/aboutTor.properties b/src/chrome/locale/en/aboutTor.properties index 02088f0..d607324 100644 --- a/src/chrome/locale/en/aboutTor.properties +++ b/src/chrome/locale/en/aboutTor.properties @@ -13,3 +13,9 @@ aboutTor.searchDDG.privacy=Search <a href="%1$S">securely</a> with <a href="%2$S aboutTor.searchDDG.privacy.link=https://duckduckgo.com/privacy.html # The following string is a link which replaces %2$S above. aboutTor.searchDDG.search.link=https://duckduckgo.com/ + +aboutTor.searchDC.privacy=Search <a href="%1$S">securely</a> with <a href="%2$S">Disconnect.me</a>. +# The following string is a link which replaces %1$S above. +aboutTor.searchDC.privacy.link=https://disconnect.me/privacy +# The following string is a link which replaces %2$S above. +aboutTor.searchDC.search.link=https://search.disconnect.me/

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit 510f2ddd444a7e656ae2cf872731226b84401b53 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jan 26 12:55:25 2015 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We add the search engine defaults directly to our central preference file in order to avoid issues like #11236 where search engine names get translated. --- browser/app/profile/000-tor-browser.js | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index dff718a..54fa6e3 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -148,8 +148,16 @@ pref("xpinstall.whitelist.add.36", ""); // Toolbar layout pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"save-page-button\",\"print-button\",\"bookmarks-menu-button\",\"history-panelmenu\",\"find-button\",\"preferences-button\",\"add-ons-button\",\"developer-button\",\"https-everywhere-button\",\"downloads-button\"],\"addon-bar\":[\"addonbar-closebutton\",\"status-bar\"],\"PersonalToolbar\":[\"personal-bookmarks\"],\"nav-bar\":[\"noscript-tbb\",\"torbutton-button\",\"urlbar-container\",\"search-container\",\"webrtc-status-button\",\"social-share-button\"],\"TabsToolbar\":[\"tabbrowser-tabs\",\"new-tab-button\",\"alltabs-button\"],\"toolbar-menubar\":[\"menubar-items\"]},\"seen\":[],\"dirtyAreaCache\":[\"PersonalToolbar\",\"nav-bar\",\"TabsToolbar\",\"toolbar-menubar\",\"PanelUI-contents\",\"addon-bar\"],\"newElementCount\":0}"); -// Omnibox settings -pref("keyword.URL", "https://startpage.com/do/search?q="); +// Putting the search engine prefs into this file to fix #11236. +// Default search engine +pref("browser.search.defaultenginename", "Startpage"); + +// Search engine order (order displayed in the search bar dropdown) +// Somewhat surprisingly we get Startpage - DuckDuckGo - Google as the order +// only if we set them as below. +pref("browser.search.order.extra.1", "DuckDuckGo"); +pref("browser.search.order.extra.2", "Google"); +pref("browser.search.order.extra.3", "Startpage"); // Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW? // Nvida cards also experience crashes without the second pref set to disabled

1 0