[Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] 3 commits: fixup! BB 42027: Base Browser migration procedures.

12 Aug 2026


      Pier Angelo Vendrame pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser


Commits:
de436cdf by Henry Wilkes at 2026-08-11T15:56:46+01:00
fixup! BB 42027: Base Browser migration procedures.

BB 45197: Clear password settings for hidden controls.

- - - - -
bf6247a4 by Henry Wilkes at 2026-08-11T15:56:47+01:00
fixup! BB 44711: Hide unwanted setting controls in Base Browser.

BB 45197: Hide the password controls if there is no password database.

- - - - -
873a7d2e by Henry Wilkes at 2026-08-11T15:57:37+01:00
fixup! Base Browser strings

BB 45197: Password manager unavailable banner string.

- - - - -


3 changed files:

- browser/components/ProfileDataUpgrader.sys.mjs
- browser/components/preferences/config/passwords-autofill.mjs
- toolkit/locales/en-US/toolkit/global/base-browser.ftl


Changes:

=====================================
browser/components/ProfileDataUpgrader.sys.mjs
=====================================
@@ -1051,6 +1051,8 @@ export let ProfileDataUpgrader = {
     // Version 7: 16.0a10: Reset safe browsing preferences. tor-browser#44802.
     //                     Also reset delete downloads preferences.
     //                     tor-browser#45187.
+    //                     Also reset password manager preferences.
+    //                     tor-browser#45197.
     const MIGRATION_VERSION = 7;
     const MIGRATION_PREF = "basebrowser.migration.version";
 
@@ -1167,9 +1169,24 @@ export let ProfileDataUpgrader = {
         // re-offer this feature again in the future. tor-browser#45187.
         "browser.download.deletePrivate",
         "browser.download.deletePrivate.chosen",
+        // Clear the password breach alert preference since it does not work.
+        // tor-browser#45197.
+        "signon.management.page.breach-alerts.enabled",
       ]) {
         Services.prefs.clearUserPref(prefName);
       }
+      if (Services.prefs.getBoolPref("security.nocertdb", true)) {
+        // Password manager does not read or write passwords from the database.
+        // We want to clear the preferences that no longer have any visible
+        // controls in the settings UI. tor-browser#45197.
+        for (const prefName of [
+          "signon.rememberSignons",
+          "signon.autofillForms",
+          "signon.generation.enabled",
+        ]) {
+          Services.prefs.clearUserPref(prefName);
+        }
+      }
     }
     Services.prefs.setIntPref(MIGRATION_PREF, MIGRATION_VERSION);
   },


=====================================
browser/components/preferences/config/passwords-autofill.mjs
=====================================
@@ -257,6 +257,7 @@ Preferences.addAll([
   { id: "signon.autofillForms", type: "bool" },
   { id: "signon.management.page.breach-alerts.enabled", type: "bool" },
   { id: "signon.firefoxRelay.feature", type: "string" },
+  { id: "security.nocertdb", type: "bool" },
 ]);
 
 Preferences.addSetting({
@@ -522,15 +523,50 @@ Preferences.addSetting(
   }
 );
 
+Preferences.addSetting({
+  id: "canSavePasswords",
+  pref: "security.nocertdb",
+  get: pref => {
+    return !pref;
+  },
+});
+
 Preferences.addSetting({
   id: "savePasswords",
   pref: "signon.rememberSignons",
+  deps: ["canSavePasswords"],
+  visible: ({ canSavePasswords }, savePasswords) => {
+    // Only show this option if the user has explicitly disabled "nocertdb", or
+    // they have somehow switched this option on. tor-browser#45197.
+    return canSavePasswords.value || savePasswords.value;
+  },
   controllingExtensionInfo: {
     storeId: "services.passwordSavingEnabled",
     l10nId: "extension-controlling-password-saving",
   },
 });
 
+Preferences.addSetting({
+  id: "showPasswordControls",
+  deps: ["canSavePasswords", "savePasswords"],
+  get: (_pref, { canSavePasswords, savePasswords }) => {
+    // Only show other password controls if the user has explicitly disabled
+    // "nocertdb", or they have somehow switched on save passwords.
+    // tor-browser#45197.
+    return canSavePasswords.value || savePasswords.value;
+  },
+});
+
+Preferences.addSetting({
+  id: "passwordsUnsupportedBanner",
+  deps: ["canSavePasswords"],
+  visible: ({ canSavePasswords }) => {
+    // NOTE: We show the banner even if disabling the password controls are
+    // visible because "savePasswords" is true.
+    return !canSavePasswords.value;
+  },
+});
+
 Preferences.addSetting({
   id: "managePasswordExceptions",
   onUserClick: () => {
@@ -551,7 +587,10 @@ Preferences.addSetting({
 
 Preferences.addSetting({
   id: "requireOSAuthForPasswords",
-  visible: () => lazy.OSKeyStore.canReauth(),
+  deps: ["showPasswordControls"],
+  visible: ({ showPasswordControls }) => {
+    return showPasswordControls.value && lazy.OSKeyStore.canReauth();
+  },
   get: () => lazy.LoginHelper.getOSAuthEnabled(),
   async set(checked) {
     const [messageText, captionText] = await Promise.all([
@@ -585,10 +624,14 @@ Preferences.addSetting({
 
 Preferences.addSetting({
   id: "manageSavedPasswords",
+  deps: ["showPasswordControls"],
   onUserClick: () => {
     PasswordSettingHelpers.showPasswords();
   },
-  visible: () => {
+  visible: ({ showPasswordControls }) => {
+    if (!showPasswordControls.value) {
+      return false;
+    }
     let policy = Services.policies.getActivePolicies();
     return policy?.PasswordManagerEnabled !== false;
   },
@@ -596,6 +639,10 @@ Preferences.addSetting({
 
 Preferences.addSetting({
   id: "additionalProtectionsGroup",
+  deps: ["showPasswordControls"],
+  visible: ({ showPasswordControls }) => {
+    return showPasswordControls.value;
+  },
 });
 
 Preferences.addSetting({
@@ -668,6 +715,10 @@ Preferences.addSetting({
 Preferences.addSetting({
   id: "breachAlerts",
   pref: "signon.management.page.breach-alerts.enabled",
+  // Even for users who force passwords to be enabled, we hide this because
+  // login breach requires "fxmonitor-breaches" remote settings, which has no
+  // local JSON dumps in Base Browser. tor-browser#45197.
+  visible: () => false,
 });
 
 Preferences.addSetting({
@@ -687,6 +738,16 @@ SettingGroupManager.registerGroups({
     l10nId: "forms-passwords-header",
     headingLevel: 2,
     items: [
+      // Add a banner to explain that passwords are unsupported.
+      // tor-browser#45197.
+      {
+        id: "passwordsUnsupportedBanner",
+        l10nId: "passwords-settings-unsupported-banner",
+        control: "moz-message-bar",
+        controlAttr: {
+          role: "status",
+        },
+      },
       {
         id: "savePasswords",
         l10nId: "forms-ask-to-save-passwords",


=====================================
toolkit/locales/en-US/toolkit/global/base-browser.ftl
=====================================
@@ -114,6 +114,13 @@ browser-layout-show-sidebar-limited =
 search-suggestions-warning-banner =
     .message = Turning this on reduces your privacy by sharing your queries with the search engine as you type.
 
+## Preferences - Passwords.
+
+# "{ -brand-short-name }" will be replaced with the localized name of the browser, e.g. "Tor Browser".
+passwords-settings-unsupported-banner =
+    .heading = Built-in password manager isn’t supported.
+    .message = { -brand-short-name }’s built-in password manager is disabled by default. This prevents your anonymous browsing from being linked to your regular identity.
+
 ## Preferences - Contrast Control.
 
 preferences-contrast-control-fixed-color2 =



View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea19...

-- 
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea19...
You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

    

Pier Angelo Vendrame (＠pierov)

tags

participants (1)