- tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-5.5] Bump HTTPS-Everywhere version
by gk＠torproject.org 03 Mar '16

03 Mar '16

commit 6f0377fe746773f4defe7eb963203b2ccb96c481 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Mar 2 07:17:07 2016 +0000 Bump HTTPS-Everywhere version We bump the version to 5.1.4 and add the new signing key --- gitian/gpg/https-everywhere.gpg | Bin 188424 -> 194394 bytes gitian/versions | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/gpg/https-everywhere.gpg b/gitian/gpg/https-everywhere.gpg index 43aa4e4..86fce24 100644 Binary files a/gitian/gpg/https-everywhere.gpg and b/gitian/gpg/https-everywhere.gpg differ diff --git a/gitian/versions b/gitian/versions index dbe56fa..81bc055 100755 --- a/gitian/versions +++ b/gitian/versions @@ -15,7 +15,7 @@ TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1-build1 TOR_TAG=tor-0.2.7.6 TORLAUNCHER_TAG=0.2.7.8 TORBUTTON_TAG=1.9.4.3 -HTTPSE_TAG=5.1.2 +HTTPSE_TAG=5.1.4 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable

1 0

[torbutton/maint-1.9.4] Bug 16725: Allow resizing with non-default homepage
by gk＠torproject.org 03 Mar '16

03 Mar '16

commit 8efd31f48447b454de98708fa899ab7bc12f85ae Author: Georg Koppen <gk(a)torproject.org> Date: Fri Feb 19 09:51:18 2016 +0000 Bug 16725: Allow resizing with non-default homepage --- src/chrome/content/torbutton.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 25b61fb..bf45fea 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1115,10 +1115,6 @@ function torbutton_on_abouttor_load(aDoc) { m_tb_prefs. setBoolPref("extensions.torbutton.show_slider_notification", false); } - - // OS-specific window maximization on start-up should be done by now. Disable - // the respective preference to make sure the user is seeing our notification. - m_tb_prefs.setBoolPref(k_tb_tor_resize_warn_pref, false); } function torbutton_is_abouttor_doc(aDoc) { @@ -3428,6 +3424,11 @@ var torbutton_resizelistener = setTimeout(function() { resizeInnerWindowTo(width, height); quantizeBrowserSize(window, 100, 100); + // OS-specific window maximization on start-up should + // be done by now. Disable the respective preference + // to make sure the user is seeing our notification. + m_tb_prefs.setBoolPref(k_tb_tor_resize_warn_pref, + false); }, 0); mut_observer.disconnect(); }

1 0

[torbutton/maint-1.9.4] Release preparations
by gk＠torproject.org 03 Mar '16

03 Mar '16

commit 90fa61653ca822e3e9fe4dca08d19cb4f54c1ba7 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Mar 3 08:22:48 2016 +0000 Release preparations Bump version to 1.9.4.4, update CHANGELOG and update translations --- src/CHANGELOG | 5 +++++ src/chrome/locale/ar/aboutTBUpdate.dtd | 2 +- src/chrome/locale/ar/torbutton.dtd | 6 +++--- src/chrome/locale/ar/torbutton.properties | 10 +++++----- src/chrome/locale/eu/aboutTor.dtd | 6 +++--- src/chrome/locale/it/torbutton.dtd | 2 +- src/install.rdf | 2 +- 7 files changed, 19 insertions(+), 14 deletions(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 933eeeb..8b2ddb1 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,8 @@ +1.9.4.4 + * Bug 16990: Don't mishandle multiline commands + * Bug 18144: about:tor update arrow position is wrong + * Bug 16725: Allow resizing with non-default homepage + 1.9.4.3 * Bug 16990: Show circuit display for connections using multi-party channels * Bug 18019: Avoid empty prompt shown after non-en-US update diff --git a/src/chrome/locale/ar/aboutTBUpdate.dtd b/src/chrome/locale/ar/aboutTBUpdate.dtd index ce40b98..41fd873 100644 --- a/src/chrome/locale/ar/aboutTBUpdate.dtd +++ b/src/chrome/locale/ar/aboutTBUpdate.dtd @@ -3,4 +3,4 @@ <!ENTITY aboutTBUpdate.linkPrefix "للحصول على أحدث المعلومات حول هذا الإصدار."> <!ENTITY aboutTBUpdate.linkLabel "زُر موقعنا"> <!ENTITY aboutTBUpdate.linkSuffix "."> -<!ENTITY aboutTBUpdate.changeLogHeading "Changelog:"> +<!ENTITY aboutTBUpdate.changeLogHeading "تغير سجل:"> diff --git a/src/chrome/locale/ar/torbutton.dtd b/src/chrome/locale/ar/torbutton.dtd index ebcbf72..b9f7205 100644 --- a/src/chrome/locale/ar/torbutton.dtd +++ b/src/chrome/locale/ar/torbutton.dtd @@ -161,7 +161,7 @@ <!ENTITY torbutton.prefs.sec_some_jit_desc "بعض محسنات نصوص الجافا معطلة"> <!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT, Type Inference, ASM.JS."> <!ENTITY torbutton.prefs.sec_baseline_jit_desc_tooltip "Baseline JIT."> -<!ENTITY torbutton.prefs.sec_jit_slower_desc "Scripts on some sites may run slower."> +<!ENTITY torbutton.prefs.sec_jit_slower_desc "سكربت في بعض المواقع قد تعمل بشكل بطيئ"> <!ENTITY torbutton.prefs.sec_jar_desc "Remote JAR files are blocked."> <!ENTITY torbutton.prefs.sec_jar_tooltip "JAR files are extremely rare on the web, but can be a source of XSS and other attacks."> <!ENTITY torbutton.prefs.sec_mathml_desc "Some mechanisms of displaying math equations are disabled."> @@ -170,13 +170,13 @@ <!ENTITY torbutton.prefs.sec_all_jit_desc "All JavaScript performance optimizations are disabled."> <!ENTITY torbutton.prefs.sec_font_rend_desc "بعض ميزات إظهار الخطوط معطلة "> <!ENTITY torbutton.prefs.sec_font_rend_graphite_tooltip "The Graphite font rendering mechanism is disabled."> -<!ENTITY torbutton.prefs.sec_svg_desc "Some types of images are disabled."> +<!ENTITY torbutton.prefs.sec_svg_desc "بعض الانواع من الصور معطله"> <!ENTITY torbutton.prefs.sec_svg_desc_tooltip "SVG images are disabled."> <!ENTITY torbutton.prefs.sec_js_https_desc "JavaScript is disabled by default on all non-HTTPS sites."> <!ENTITY torbutton.prefs.sec_js_desc_tooltip "JavaScript can be enabled on a per-site basis via the NoScript toolbar button."> <!ENTITY torbutton.prefs.sec_high "عالٍ"> <!ENTITY torbutton.prefs.sec_all_js_desc "JavaScript is disabled by default on all sites."> -<!ENTITY torbutton.prefs.sec_audio_video_desc "Most audio and video formats are disabled."> +<!ENTITY torbutton.prefs.sec_audio_video_desc "معضم صيغ السمعيات والمرئيات معطلة"> <!ENTITY torbutton.prefs.sec_audio_video_desc_tooltip "WebM is the only codec that remains enabled."> <!ENTITY torbutton.prefs.sec_webfonts_desc "من الممكن أن بعض الخطوط والايقونات معروضة خطأ"> <!ENTITY torbutton.prefs.sec_webfonts_desc_tooltip "Website-provided font files are blocked."> diff --git a/src/chrome/locale/ar/torbutton.properties b/src/chrome/locale/ar/torbutton.properties index 6828a3e..4603989 100644 --- a/src/chrome/locale/ar/torbutton.properties +++ b/src/chrome/locale/ar/torbutton.properties @@ -2,12 +2,12 @@ torbutton.button.tooltip.disabled = فعّل تور torbutton.button.tooltip.enabled = عطّل تور torbutton.circuit_display.internet = انترنت torbutton.circuit_display.ip_unknown = IP غير معروف -torbutton.circuit_display.onion_site = Onion site +torbutton.circuit_display.onion_site = موقع اونيون torbutton.circuit_display.this_browser = هذا المتصفح -torbutton.circuit_display.relay = relay +torbutton.circuit_display.relay = مُرحل torbutton.circuit_display.tor_bridge = جسر torbutton.circuit_display.unknown_country = بلد غير معروف -torbutton.content_sizer.margin_tooltip = Tor Browser adds this margin to make the width and height of your window less distinctive, and thus reduces the ability of people to track you online. +torbutton.content_sizer.margin_tooltip = يضيف متصفح تور هذا الهامش لابقاء نافذتك غير مميزه، لتقليل امكانيه تقفيك عبر الانترنت. torbutton.panel.tooltip.disabled = انقر لتفعيل تور torbutton.panel.tooltip.enabled = انقر لتعطيل تور torbutton.panel.plugins.disabled = انقر لتفعيل الملحقات @@ -59,7 +59,7 @@ torbutton.popup.confirm_newnym = متصفح تور torbutton.slider_notification = The green onion menu now has a security slider which lets you adjust your security level. Check it out! torbutton.slider_notification_button = Open security settings -torbutton.maximize_warning = Maximizing Tor Browser can allow websites to determine your monitor size, which can be used to track you. We recommend that you leave Tor Browser windows in their original default size. +torbutton.maximize_warning = تكبير متصفح تور قد يسمح لبعض المواقع بالتعرف على حجم شاشتك، واستخدام هذه المعلومات لتقفيك. نوصي بابقاء نافذه متصف تور على حجمها الافتراضي. # Canvas permission prompt. Strings are kept here for ease of translation. canvas.siteprompt=هذا الموقع (٪ S) حاول استخراج بيانات الصورة HTML5، والتي يمكن استخدامها لتحديد مكانك وتحديد الكومبيوتر.\n\nهل تريد أن يسمح متصفح Tor لهذا الموقع لاستخراج بيانات الصورة ؟ @@ -72,7 +72,7 @@ canvas.neverAccessKey=ط # Profile/startup error messages. Strings are kept here for ease of translation. # LOCALIZATION NOTE: %S is the application name. -profileProblemTitle=%S Profile Problem +profileProblemTitle=%Sمشكله في ملف شخصي profileReadOnly=You cannot run %S from a read-only file system. Please copy %S to another location before trying to use it. profileReadOnlyMac=You cannot run %S from a read-only file system. Please copy %S to your Desktop or Applications folder before trying to use it. profileAccessDenied=%S does not have permission to access the profile. Please adjust your file system permissions and try again. diff --git a/src/chrome/locale/eu/aboutTor.dtd b/src/chrome/locale/eu/aboutTor.dtd index 76020fc..7524fc2 100644 --- a/src/chrome/locale/eu/aboutTor.dtd +++ b/src/chrome/locale/eu/aboutTor.dtd @@ -6,14 +6,14 @@ <!ENTITY aboutTor.title "Tori buruz"> -<!ENTITY aboutTor.outOfDateTorOn.label "WARNING: this browser is out of date."> +<!ENTITY aboutTor.outOfDateTorOn.label "KONUTZ: nabigatzaile hau zaharkituta dago."> <!ENTITY aboutTor.outOfDateTorOff.label "BAITA, nabigatzaile hau zaharkituta dago."> <!ENTITY aboutTor.outOfDate2.label "Tipulan sakatu eta ondoren Tor Browser Bundlea egiaztatu hautatu"> <!ENTITY aboutTor.check.label "Tor sare ezarpenak frogatu"> -<!ENTITY aboutTor.success.label "Welcome to Tor Browser"> -<!ENTITY aboutTor.success2.label "Connected to the Tor network."> +<!ENTITY aboutTor.success.label "Ongi etorri Tor Browserera"> +<!ENTITY aboutTor.success2.label "Tor sarera konektatuta."> <!ENTITY aboutTor.success3.label "Aske zara orain Internet anonimotasunez nabigatzeko."> <!ENTITY aboutTor.failure.label "Zerbait gaizki joan da!"> <!ENTITY aboutTor.failure2.label "Tor ez da nabigatzaile honetan funtzionatzen ari."> diff --git a/src/chrome/locale/it/torbutton.dtd b/src/chrome/locale/it/torbutton.dtd index c92526f..f08b41d 100644 --- a/src/chrome/locale/it/torbutton.dtd +++ b/src/chrome/locale/it/torbutton.dtd @@ -180,6 +180,6 @@ <!ENTITY torbutton.prefs.sec_audio_video_desc_tooltip "WebM è l'unico codec che rimane abilitato."> <!ENTITY torbutton.prefs.sec_webfonts_desc "Alcuni caratteri e icone possono non essere visualizzati correttamente."> <!ENTITY torbutton.prefs.sec_webfonts_desc_tooltip "I font provvisti dal sito sono bloccati."> -<!ENTITY torbutton.prefs.sec_custom "Valori Customizzabili"> +<!ENTITY torbutton.prefs.sec_custom "Valori personalizzati"> <!ENTITY torbutton.circuit_display.title "Circuito Tor per questo sito"> diff --git a/src/install.rdf b/src/install.rdf index 0e59a9a..da11107 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.4.3</em:version> + <em:version>1.9.4.4</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/maint-1.9.4] Bug 16690: Don't mishandle multiline commands
by gk＠torproject.org 01 Mar '16

01 Mar '16

commit e9fc7e9e3becded38c87e92a864c44bcd68219c5 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Feb 5 17:38:42 2016 -0800 Bug 16690: Don't mishandle multiline commands Also, when logging, don't show a bunch of extra newlines. See https://trac.torproject.org/16990#comment:28 --- src/modules/tor-control-port.js | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index c5010de..e1ee6bc 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -27,11 +27,11 @@ Cu.import("resource://gre/modules/Services.jsm"); // Logging function let log; if ((typeof console) !== "undefined") { - log = x => console.log(typeof(x) === "string" ? x : JSON.stringify(x)); + log = x => console.log(typeof(x) === "string" ? x.trimRight().replace(/\r\n/g, "\n") : JSON.stringify(x)); } else { let logger = Cc["@torproject.org/torbutton-logger;1"] .getService(Components.interfaces.nsISupports).wrappedJSObject; - log = x => logger.eclog(3, x); + log = x => logger.eclog(3, x.trimRight().replace(/\r\n/g, "\n")); } // ### announce this file @@ -113,7 +113,7 @@ io.asyncSocket = function (host, port, onInputData, onError) { let totalString = pendingWrites.join(""); try { outputStream.write(totalString, totalString.length); - log("controlPort << " + aString + "\n"); + log("controlPort << " + totalString); } catch (err) { onError(err); } @@ -156,13 +156,26 @@ io.onDataFromOnLine = function (onLine) { // callback that expects individual lines. io.onLineFromOnMessage = function (onMessage) { // A private variable that stores the last unfinished line. - let pendingLines = []; + let pendingLines = [], + // A private variable to monitor whether we are receiving a multiline + // value, beginning with ###+ and ending with a single ".". + multilineValueInProgress = false; // Return a callback that expects individual lines. return function (line) { // Add to the list of pending lines. pendingLines.push(line); + // 'Multiline values' are possible. We avoid interrupting one by detecting it + // and waiting for a terminating "." on its own line. + // (See control-spec section 3.9 and https://trac.torproject.org/16990#comment:28 + if (line.match(/^\d\d\d\+.+?=$/) && pendingLines.length === 1) { + multilineValueInProgress = true; + } + if (multilineValueInProgress && line.match(/^\.$/)) { + multilineValueInProgress = false; + } // If line is the last in a message, then pass on the full multiline message. - if (line.match(/^\d\d\d /) && + if (!multilineValueInProgress && + line.match(/^\d\d\d /) && (pendingLines.length === 1 || pendingLines[0].substring(0,3) === line.substring(0,3))) { // Combine pending lines to form message.

1 0

[torbutton/master] Bug 16690: Don't mishandle multiline commands
by gk＠torproject.org 01 Mar '16

01 Mar '16

commit 5bffe0559f6fbf25d425c19f32d75b5ba0ae1a99 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Feb 5 17:38:42 2016 -0800 Bug 16690: Don't mishandle multiline commands Also, when logging, don't show a bunch of extra newlines. See https://trac.torproject.org/16990#comment:28 --- src/modules/tor-control-port.js | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index c5010de..e1ee6bc 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -27,11 +27,11 @@ Cu.import("resource://gre/modules/Services.jsm"); // Logging function let log; if ((typeof console) !== "undefined") { - log = x => console.log(typeof(x) === "string" ? x : JSON.stringify(x)); + log = x => console.log(typeof(x) === "string" ? x.trimRight().replace(/\r\n/g, "\n") : JSON.stringify(x)); } else { let logger = Cc["@torproject.org/torbutton-logger;1"] .getService(Components.interfaces.nsISupports).wrappedJSObject; - log = x => logger.eclog(3, x); + log = x => logger.eclog(3, x.trimRight().replace(/\r\n/g, "\n")); } // ### announce this file @@ -113,7 +113,7 @@ io.asyncSocket = function (host, port, onInputData, onError) { let totalString = pendingWrites.join(""); try { outputStream.write(totalString, totalString.length); - log("controlPort << " + aString + "\n"); + log("controlPort << " + totalString); } catch (err) { onError(err); } @@ -156,13 +156,26 @@ io.onDataFromOnLine = function (onLine) { // callback that expects individual lines. io.onLineFromOnMessage = function (onMessage) { // A private variable that stores the last unfinished line. - let pendingLines = []; + let pendingLines = [], + // A private variable to monitor whether we are receiving a multiline + // value, beginning with ###+ and ending with a single ".". + multilineValueInProgress = false; // Return a callback that expects individual lines. return function (line) { // Add to the list of pending lines. pendingLines.push(line); + // 'Multiline values' are possible. We avoid interrupting one by detecting it + // and waiting for a terminating "." on its own line. + // (See control-spec section 3.9 and https://trac.torproject.org/16990#comment:28 + if (line.match(/^\d\d\d\+.+?=$/) && pendingLines.length === 1) { + multilineValueInProgress = true; + } + if (multilineValueInProgress && line.match(/^\.$/)) { + multilineValueInProgress = false; + } // If line is the last in a message, then pass on the full multiline message. - if (line.match(/^\d\d\d /) && + if (!multilineValueInProgress && + line.match(/^\d\d\d /) && (pendingLines.length === 1 || pendingLines[0].substring(0,3) === line.substring(0,3))) { // Combine pending lines to form message.

1 0

[tor-browser/tor-browser-38.6.1esr-6.0-1] squash! Bug #13749.2: Regression tests for first-party isolation of cache
by gk＠torproject.org 19 Feb '16

19 Feb '16

commit df2cdeb77b7133ea672920caa8c2eac5d69f71c6 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Feb 17 22:19:31 2016 -0800 squash! Bug #13749.2: Regression tests for first-party isolation of cache Also checks first-party isolation of favicons: https://bugs.torproject.org/16728 --- netwerk/test/browser/browser.ini | 1 + netwerk/test/browser/browser_cacheFirstParty.js | 21 ++++++++++++--------- netwerk/test/browser/firstPartyGrandParent.html | 4 +++- netwerk/test/browser/firstPartyParent.html | 4 +++- netwerk/test/browser/thirdPartyChild.favicon.ico | Bin 0 -> 1150 bytes 5 files changed, 19 insertions(+), 11 deletions(-) diff --git a/netwerk/test/browser/browser.ini b/netwerk/test/browser/browser.ini index ca711b7..5ab1546 100644 --- a/netwerk/test/browser/browser.ini +++ b/netwerk/test/browser/browser.ini @@ -14,6 +14,7 @@ support-files = thirdPartyChild.worker.xhr.html thirdPartyChild.xhr.html thirdPartyChild.track.vtt + thirdPartyChild.favicon.ico [browser_cacheFirstParty.js] [browser_NetUtil.js] diff --git a/netwerk/test/browser/browser_cacheFirstParty.js b/netwerk/test/browser/browser_cacheFirstParty.js index c23f669..c1b5ee6 100644 --- a/netwerk/test/browser/browser_cacheFirstParty.js +++ b/netwerk/test/browser/browser_cacheFirstParty.js @@ -4,12 +4,13 @@ // ("privacy.thirdparty.isolate" pref is set to 2) then when a loaded file is cached, // it is indexed by the URL-bar domain. -// In this test, a number of files are loaded (via IFRAME, LINK, SCRIPT, IMG, OBJECT, -// EMBED, AUDIO, VIDEO, TRACK and XMLHttpRequest) by parent pages with different URL bar -// domains. When isolation is active, we test to confirm that a separate copy of each file -// is cached for each different parent domain. We also test to make sure that when -// isolation is inactive, a single copy of the child page is cached and reused for all -// parent domains. +// In this test, a number of files are loaded (via IFRAME, LINK [both CSS +// and Favicon], SCRIPT, IMG, OBJECT, EMBED, AUDIO, VIDEO, TRACK and +// XMLHttpRequest) by parent pages with different URL bar domains. When +// isolation is active, we test to confirm that a separate copy of each file is +// cached for each different parent domain. We also test to make sure that when +// isolation is inactive, a single copy of the child page is cached +// and reused for all parent domains. // In this file, functions are defined in call stack order (later functions call earlier // functions). Comments are formatted for docco. @@ -104,13 +105,15 @@ let privacyPref = "privacy.thirdparty.isolate", // share cached embedded objects. duplicatedDomains = [].concat(domains, domains), // We will check cache for example.net content from - // iframe, link, script, img, object, embed, xhr, audio, video, track + // iframe, link (css), script, img, object, embed, xhr, audio, video, + // track, favicon suffixes = ["iframe.html", "link.css", "script.js", "img.png", "object.png", - "embed.png", "xhr.html", "worker.xhr.html", "audio.ogg", "video.ogv", "track.vtt" ]; + "embed.png", "xhr.html", "worker.xhr.html", "audio.ogg", + "video.ogv", "track.vtt", "favicon.ico" ]; // __checkCachePopulation(pref, numberOfDomains)__. // Check if the number of entries found in the cache for each -// embedded file type matches the number we expect, given the +// embedded file type matches the number we expect, given the // number of domains and the isolation state. let checkCachePopulation = function* (pref, numberOfDomains) { let expectedEntryCount = (pref === 2) ? numberOfDomains : 1; diff --git a/netwerk/test/browser/firstPartyGrandParent.html b/netwerk/test/browser/firstPartyGrandParent.html index c990831..969b429 100644 --- a/netwerk/test/browser/firstPartyGrandParent.html +++ b/netwerk/test/browser/firstPartyGrandParent.html @@ -1,7 +1,9 @@ <!DOCTYPE html> <html> <head> -<meta content="text/html;charset=utf-8" http-equiv="Content-Type"> + <meta content="text/html;charset=utf-8" http-equiv="Content-Type"> + <link rel="icon" type="image/ico" + href="http://example.net/browser/netwerk/test/browser/thirdPartyChild.favicon.ico"> </head> <frameset cols="50%,50%"> <frame src="http://example.net/browser/netwerk/test/browser/firstPartyParent.html"> diff --git a/netwerk/test/browser/firstPartyParent.html b/netwerk/test/browser/firstPartyParent.html index 7f2f5c8..fa29a74 100644 --- a/netwerk/test/browser/firstPartyParent.html +++ b/netwerk/test/browser/firstPartyParent.html @@ -5,6 +5,8 @@ <head> <link rel="stylesheet" type="text/css" href="http://example.net/browser/netwerk/test/browser/thirdPartyChild.link.css"> + <link rel="icon" type="image/ico" + href="http://example.net/browser/netwerk/test/browser/thirdPartyChild.favicon.ico"> </head> <body> <div>firstPartyParent.html</div> @@ -26,7 +28,7 @@ <source src="http://example.net/browser/netwerk/test/browser/thirdPartyChild.audio.ogg" type="audio/ogg"> <track src="http://example.net/browser/netwerk/test/browser/thirdPartyChild.track.vtt" - kind="subtitles"> + kind="subtitles"> </audio> <video id="video" diff --git a/netwerk/test/browser/thirdPartyChild.favicon.ico b/netwerk/test/browser/thirdPartyChild.favicon.ico new file mode 100644 index 0000000..48060b1 Binary files /dev/null and b/netwerk/test/browser/thirdPartyChild.favicon.ico differ

1 0

[tor-browser/tor-browser-38.6.1esr-5.5-1] Bug 18170: After update, only changelog tab shown
by gk＠torproject.org 18 Feb '16

18 Feb '16

commit 17015208f6a990a22a89980bf495618009cf1ef8 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Feb 3 15:22:12 2016 -0500 Bug 18170: After update, only changelog tab shown When in permanent private browsing mode, always return false for isAutomaticRestoreEnabled. This ensures that there will not be any confusion inside nsBrowserContentHandler.defaultArgs as to whether a one time session restore will occur. Also, for consistency and in case someone looks at the pref, avoid setting browser.sessionstore.resume_session = true during browser shutdown. This bug occurred when staging was not used during the update process. On Windows it always occurred because staging is not used even when it should be (see #18292). --- browser/components/nsBrowserGlue.js | 4 +++- browser/components/sessionstore/SessionStore.jsm | 5 ++++- browser/components/sessionstore/nsSessionStartup.js | 4 ++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js index 61e070f..20fefe6 100644 --- a/browser/components/nsBrowserGlue.js +++ b/browser/components/nsBrowserGlue.js @@ -226,7 +226,9 @@ BrowserGlue.prototype = { if (!this._saveSession && !aForce) return; - Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true); + if (!PrivateBrowsingUtils.permanentPrivateBrowsing) { + Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true); + } // This method can be called via [NSApplication terminate:] on Mac, which // ends up causing prefs not to be flushed to disk, so we need to do that diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm index 64017f7..3b963bf 100644 --- a/browser/components/sessionstore/SessionStore.jsm +++ b/browser/components/sessionstore/SessionStore.jsm @@ -1165,7 +1165,10 @@ let SessionStoreInternal = { */ onQuitApplication: function ssi_onQuitApplication(aData) { if (aData == "restart") { - this._prefBranch.setBoolPref("sessionstore.resume_session_once", true); + if (!PrivateBrowsingUtils.permanentPrivateBrowsing) { + this._prefBranch.setBoolPref("sessionstore.resume_session_once", true); + } + // The browser:purge-session-history notification fires after the // quit-application notification so unregister the // browser:purge-session-history notification to prevent clearing diff --git a/browser/components/sessionstore/nsSessionStartup.js b/browser/components/sessionstore/nsSessionStartup.js index 7c09a61..faf7863 100644 --- a/browser/components/sessionstore/nsSessionStartup.js +++ b/browser/components/sessionstore/nsSessionStartup.js @@ -291,6 +291,10 @@ SessionStartup.prototype = { * @returns bool */ isAutomaticRestoreEnabled: function () { + if (PrivateBrowsingUtils.permanentPrivateBrowsing) { + return false; + } + return Services.prefs.getBoolPref("browser.sessionstore.resume_session_once") || Services.prefs.getIntPref("browser.startup.page") == BROWSER_STARTUP_RESUME_SESSION; },

1 0

[tor-browser/tor-browser-38.6.1esr-6.0-1] Bug 18170: After update, only changelog tab shown
by gk＠torproject.org 18 Feb '16

18 Feb '16

commit 7c8b836e87bc2e5251ff085d48114d61678544d3 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Feb 3 15:22:12 2016 -0500 Bug 18170: After update, only changelog tab shown When in permanent private browsing mode, always return false for isAutomaticRestoreEnabled. This ensures that there will not be any confusion inside nsBrowserContentHandler.defaultArgs as to whether a one time session restore will occur. Also, for consistency and in case someone looks at the pref, avoid setting browser.sessionstore.resume_session = true during browser shutdown. This bug occurred when staging was not used during the update process. On Windows it always occurred because staging is not used even when it should be (see #18292). --- browser/components/nsBrowserGlue.js | 4 +++- browser/components/sessionstore/SessionStore.jsm | 5 ++++- browser/components/sessionstore/nsSessionStartup.js | 4 ++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js index 61e070f..20fefe6 100644 --- a/browser/components/nsBrowserGlue.js +++ b/browser/components/nsBrowserGlue.js @@ -226,7 +226,9 @@ BrowserGlue.prototype = { if (!this._saveSession && !aForce) return; - Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true); + if (!PrivateBrowsingUtils.permanentPrivateBrowsing) { + Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true); + } // This method can be called via [NSApplication terminate:] on Mac, which // ends up causing prefs not to be flushed to disk, so we need to do that diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm index 64017f7..3b963bf 100644 --- a/browser/components/sessionstore/SessionStore.jsm +++ b/browser/components/sessionstore/SessionStore.jsm @@ -1165,7 +1165,10 @@ let SessionStoreInternal = { */ onQuitApplication: function ssi_onQuitApplication(aData) { if (aData == "restart") { - this._prefBranch.setBoolPref("sessionstore.resume_session_once", true); + if (!PrivateBrowsingUtils.permanentPrivateBrowsing) { + this._prefBranch.setBoolPref("sessionstore.resume_session_once", true); + } + // The browser:purge-session-history notification fires after the // quit-application notification so unregister the // browser:purge-session-history notification to prevent clearing diff --git a/browser/components/sessionstore/nsSessionStartup.js b/browser/components/sessionstore/nsSessionStartup.js index 7c09a61..faf7863 100644 --- a/browser/components/sessionstore/nsSessionStartup.js +++ b/browser/components/sessionstore/nsSessionStartup.js @@ -291,6 +291,10 @@ SessionStartup.prototype = { * @returns bool */ isAutomaticRestoreEnabled: function () { + if (PrivateBrowsingUtils.permanentPrivateBrowsing) { + return false; + } + return Services.prefs.getBoolPref("browser.sessionstore.resume_session_once") || Services.prefs.getIntPref("browser.startup.page") == BROWSER_STARTUP_RESUME_SESSION; },

1 0

[tor-browser/tor-browser-38.6.1esr-6.0-1] fixup! Bug #13670.1: Isolate favicon requests by first party
by gk＠torproject.org 18 Feb '16

18 Feb '16

commit 222689b3944533ebb97c809b8b6f508975dd45e3 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun Jan 17 23:32:59 2016 -0800 fixup! Bug #13670.1: Isolate favicon requests by first party Fixes https://bugs.torproject.org/18030, "Favicons loaded via the Page Info dialog are not going over the same circuit as the URL bar domain" --- browser/base/content/pageinfo/pageInfo.js | 2 ++ dom/base/nsContentUtils.cpp | 2 +- dom/base/nsImageLoadingContent.cpp | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js index 4c75d65..6183532 100644 --- a/browser/base/content/pageinfo/pageInfo.js +++ b/browser/base/content/pageinfo/pageInfo.js @@ -970,6 +970,8 @@ function makePreview(row) var newImage = new Image; newImage.id = "thepreviewimage"; + // Ensure "Media" items are fetched over the first-party domain. + newImage.setAttribute("firstparty", gWindow.top.document.location); var physWidth = 0, physHeight = 0; var width = 0, height = 0; diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 5d3dea7..67cd53b 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -3000,7 +3000,7 @@ nsContentUtils::LoadImage(nsIURI* aURI, nsINode* aLoadingNode, NS_PRECONDITION(aLoadingPrincipal, "Must have a principal"); NS_PRECONDITION(aRequest, "Null out param"); - nsCOMPtr<nsIDocument> aLoadingDocument(aLoadingNode ? aLoadingNode->GetCurrentDoc() : nullptr); + nsCOMPtr<nsIDocument> aLoadingDocument(aLoadingNode ? aLoadingNode->OwnerDoc() : nullptr); imgLoader* imgLoader = GetImgLoaderForDocument(aLoadingDocument); if (!imgLoader) { diff --git a/dom/base/nsImageLoadingContent.cpp b/dom/base/nsImageLoadingContent.cpp index 55c2bd7..64ec1d4 100644 --- a/dom/base/nsImageLoadingContent.cpp +++ b/dom/base/nsImageLoadingContent.cpp @@ -932,7 +932,7 @@ nsImageLoadingContent::LoadImage(nsIURI* aNewURI, nsCOMPtr<nsIContent> content = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this)); nsresult rv; - rv = nsContentUtils::LoadImage(aNewURI, aDocument, + rv = nsContentUtils::LoadImage(aNewURI, content, aDocument->NodePrincipal(), aDocument->GetDocumentURI(), aDocument->GetReferrerPolicy(),

1 0

[tor-browser/tor-browser-38.6.1esr-5.5-1] fixup! Bug #13670.1: Isolate favicon requests by first party
by gk＠torproject.org 18 Feb '16

18 Feb '16

commit b9e7d044aa52c8cda48c73616d70324f666fe1e7 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun Jan 17 23:32:59 2016 -0800 fixup! Bug #13670.1: Isolate favicon requests by first party Fixes https://bugs.torproject.org/18030, "Favicons loaded via the Page Info dialog are not going over the same circuit as the URL bar domain" --- browser/base/content/pageinfo/pageInfo.js | 2 ++ dom/base/nsContentUtils.cpp | 2 +- dom/base/nsImageLoadingContent.cpp | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js index 4c75d65..6183532 100644 --- a/browser/base/content/pageinfo/pageInfo.js +++ b/browser/base/content/pageinfo/pageInfo.js @@ -970,6 +970,8 @@ function makePreview(row) var newImage = new Image; newImage.id = "thepreviewimage"; + // Ensure "Media" items are fetched over the first-party domain. + newImage.setAttribute("firstparty", gWindow.top.document.location); var physWidth = 0, physHeight = 0; var width = 0, height = 0; diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 5d3dea7..67cd53b 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -3000,7 +3000,7 @@ nsContentUtils::LoadImage(nsIURI* aURI, nsINode* aLoadingNode, NS_PRECONDITION(aLoadingPrincipal, "Must have a principal"); NS_PRECONDITION(aRequest, "Null out param"); - nsCOMPtr<nsIDocument> aLoadingDocument(aLoadingNode ? aLoadingNode->GetCurrentDoc() : nullptr); + nsCOMPtr<nsIDocument> aLoadingDocument(aLoadingNode ? aLoadingNode->OwnerDoc() : nullptr); imgLoader* imgLoader = GetImgLoaderForDocument(aLoadingDocument); if (!imgLoader) { diff --git a/dom/base/nsImageLoadingContent.cpp b/dom/base/nsImageLoadingContent.cpp index 55c2bd7..64ec1d4 100644 --- a/dom/base/nsImageLoadingContent.cpp +++ b/dom/base/nsImageLoadingContent.cpp @@ -932,7 +932,7 @@ nsImageLoadingContent::LoadImage(nsIURI* aNewURI, nsCOMPtr<nsIContent> content = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this)); nsresult rv; - rv = nsContentUtils::LoadImage(aNewURI, aDocument, + rv = nsContentUtils::LoadImage(aNewURI, content, aDocument->NodePrincipal(), aDocument->GetDocumentURI(), aDocument->GetReferrerPolicy(),

1 0