Richard Pospesel pushed to branch tor-browser-102.8.0esr-12.5-1 at The Tor Project / Applications / Tor Browser

Commits: 90df17da by Richard Pospesel at 2023-02-15T13:37:32+00:00 fixup! Firefox preference overrides.

bug 41627: Enable network.http.referer.hideOnionSource in base-browser

- - - - - a697a2c0 by Richard Pospesel at 2023-02-15T13:38:06+00:00 fixup! Bug 40562: Added Tor Browser preferences to 000-tor-browser.js

bug 41627: Enable network.http.referer.hideOnionSource in base-browser

- - - - -

2 changed files:

- browser/app/profile/000-tor-browser.js - browser/app/profile/001-base-profile.js

Changes:

===================================== browser/app/profile/000-tor-browser.js ===================================== @@ -38,9 +38,6 @@ pref("dom.securecontext.allowlist_onions", true); // Disable HTTPS-Only mode for .onion domains (tor-browser#19850) pref("dom.security.https_only_mode.upgrade_onion", false);

-// tor-browser#22320: Hide referer when comming from a .onion address -pref("network.http.referer.hideOnionSource", true); - // Bug 40423/41137: Disable http/3 // We should re-enable it as soon as Tor gets UDP support pref("network.http.http3.enabled", false);

===================================== browser/app/profile/001-base-profile.js ===================================== @@ -68,6 +68,12 @@ pref("browser.pagethumbnails.capturing_disabled", true); pref("dom.security.https_only_mode", true); pref("dom.security.https_only_mode_pbm", true);

+// tor-browser#22320: Hide referer when comming from a .onion address +// We enable this here (rather than in Tor Browser) in case users of other +// base-browser derived browsers configure it to use a system Tor daemon +// to visit onion services. +pref("network.http.referer.hideOnionSource", true); + // Require Safe Negotiation ( https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27719 ) // Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a // MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations

View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/33b90e5...