summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Bug 1517: Reduce precision of time for Javascript.bug1517-draftMike Perry2015-04-21
| | | | | | Draft patch. Probably doesn't even compile. Note to self: Test this on a bunch of Javascript games and video sites.
* Bug 14716: HTTP Basic Authentication prompt only displayed onceKathy Brade2015-04-17
| | | | | Modify the login manager implementation to handle the situation where storage is not available.
* Merge remote-tracking branch 'gk/bug_10761_v2' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-15
|\
| * Bug 10761: Fix shutdown crashes on WindowsGeorg Koppen2015-04-14
| | | | | | | | | | | | | | Jacek Caban gave us this patch which should fix the shutdown crashes on Windows (#10761 and #14454) as newer GCC/Binutils versions do not need the workaround anymore that got implemented back then in https://bugzilla.mozilla.org/show_bug.cgi?id=337887.
* | Revert "TB1: Add a string-based cacheKey."Mike Perry2015-04-15
| | | | | | | | | | | | This reverts commit 53f8f2506cb21bf1847a4261ef383db9be55a93c. This used to be used by Torbutton/SafeCache, but we moved the cache isolation to direct C++ patches instead.
* | Merge remote-tracking branch 'arthur/13875' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-15
|\ \
| * | fixup! Bug #5856: Do not expose physical screen info via window & window.screen.Arthur Edelstein2015-04-08
| | |
* | | fixup! TB4: Tor Browser's Firefox preference overrides.Georg Koppen2015-04-14
| | | | | | | | | | | | | | | We remove the keep-alive restriction now that we have isolation to the URL bar domain which is governing this as well (see: bug 4100).
* | | fixup! Bug #3455.2. Allow RFC1929 authentication (username/password) to ↵Georg Koppen2015-04-14
|/ / | | | | | | SOCKS servers.
* | fixup! TB4: Tor Browser's Firefox preference overrides.Arthur Edelstein2015-04-02
|/
* Bug 10895: Fix versioning for langpacks.Mike Perry2015-03-26
|
* Bug 10280: Don't load any plugins into the address space.Mike Perry2015-03-26
| | | | | | | | | If the pref "plugin.disable" is set, the user has to click an extra button to cause Firefox to actually scan the filesystem for plugins. Note: The strings for this patch are actually present in Torbutton. Patch by 'disgleirio'.
* Bug 15406: Only include forced updates if extensions differ.Kathy Brade2015-03-26
| | | | | | | | | For the NoScript and HTTPS Everywhere extensions, only force files to be included in incremental MARs if the extension has changed. For NoScript we detect this by comparing the old and new .xpi files. For HTTPS Everywhere (which is unpacked) we only check install.rdf; our assumption is that the version number will be changed for each new release.
* Bug 15406: Do not force updates for Torbutton and Tor Launcher.Kathy Brade2015-03-26
| | | | | | | | | | Since we have disabled updates for Torbutton and Tor Launcher, there is no need to force these extensions to be updated (replaced) when generating our incremental MAR files. Also, we no longer force an update to the pdf.js extension (it is now built into the browser) or to the firefox binary on Mac OS (Mozilla forces firefox to be replaced on Mac OS due to code signing / signature issues with partner builds; see https://bugzilla.mozilla.org/show_bug.cgi?id=770996).
* Bug 13548: Create preference to disable MathML.Kathy Brade2015-03-26
| | | | | If the mathml.disabled preference is true, treat <math> and other MathML elements as generic XML elements.
* Bug 12827: Create preference to disable SVG.Kathy Brade2015-03-26
| | | | | | | | | | | | | | | If the svg.in-content.enabled preference is false, disallow all use of SVG within content pages. In the following situations it is very difficult to determine if code is executing within a chrome context or not: SVG hasFeature() API. SVG hasExtension() API. Use of SVG glyphs within custom OpenType fonts. In these cases, everything is assumed to be content; that is, setting the pref. to false will block use of the above features from chrome as well. This is OK because these features are unlikely to be used by core browser code.
* Bug 15201: Windows: disable "runas" code path in updater.Kathy Brade2015-03-26
| | | | | | Instead of using "runas" to try to elevate privileges, the updater now fails if the user does not have permission to apply an update. This avoids potential security issues such as CVE-2015-0833.
* Bug 14631: Improve profile access error msgs (strings).Kathy Brade2015-03-26
| | | | | To allow for localization, get profile-related error strings from Torbutton. Use app display name ("Tor Browser") in profile-related error alerts.
* Bug 14631: Improve profile access error messages.Kathy Brade2015-03-26
| | | | | Instead of always reporting that the profile is locked, display specific messages for "access denied" and "read-only file system".
* Bug 13900: Remove 3rd party HTTP auth tokens.Kathy Brade2015-03-26
| | | | | | | | Prevent user tracking via HTTP Basic Authentication by removing Authorization headers from third party requests. This is a port of a piece of the Stanford SafeCache code that previously was included in Torbutton.
* Bug 14392: Make about:tor behave like other initial pages.Mike Perry2015-03-26
|
* Bug 12430: Disable external jar: via preferenceGeorg Koppen2015-03-26
| | | | | | This is a patch written by Jeff Gibat (iSECPartners) to disable the jar: protocol handler via a preference. The preference is bound to the security slider settings (#9387).
* Bug #13749.2: Regression tests for first-party isolation of cacheArthur Edelstein2015-03-26
| | | | | | | | | | | | | This test ensures that if first-party isolation is enabled ("privacy.thirdparty.isolate" pref is set to 2) then when a loaded file is cached, it is indexed by the URL-bar domain. In this test, a number of files are loaded (via IFRAME, LINK, SCRIPT, IMG, OBJECT, EMBED, AUDIO, VIDEO, TRACK and XMLHttpRequest) by parent pages with different URL bar domains. When isolation is active, we test to confirm that a separate copy of each file is cached for each different parent domain. We also test to make sure that when isolation is inactive, a single copy of the child page is cached and reused for all parent domains.
* Bug #13749.1: regression tests for first party isolation of localStorageArthur Edelstein2015-03-26
|
* Bug 13379: Adding our MAR signing keys.Georg Koppen2015-03-26
|
* Bug 13379: Sign our MAR files.Kathy Brade2015-03-26
| | | | | | | | | | | | | | | | | Configure with --enable-signmar (build the signmar tool). Configure with --enable-verify-mar (when updating, require a valid signature on the MAR file before it is applied). Use the Tor Browser version instead of the Firefox version inside the MAR file info block (necessary to prevent downgrade attacks). Use NSS on all platforms for checking MAR signatures (Mozilla plans to use OS-native APIs on Mac OS and they already do so on Windows). So that the NSS and NSPR libraries the updater depends on can be found at runtime, we add the firefox directory to the shared library search path on all platforms. Use SHA512-based MAR signatures instead of the SHA1-based ones that Mozilla uses. This is implemented inside MAR_USE_SHA512_RSA_SIG #ifdef's and with a signature algorithm ID of 512 to help avoid collisions with future work Mozilla might do in this area. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1105689
* Bug 13379: Sign our MAR files (backport Mozilla patches).Kathy Brade2015-03-26
| | | | | | | | Backport reviewed patches from these two Mozilla bugs: 903135 - Link updater to NSS and enable MAR verification on Linux and OSX 903126 - Implement a platform independent way to determine which cert to use for verifying mars Configure browser build with --enable-signmar and --enable-verify-mar.
* Bug 902761 - Stop storing certs used for MAR verification in EXE resource ↵Brian R. Bondy2015-03-26
| | | | files. r=rstrong
* Bug 902761 - Build configuration for turning .der files into .h files. r=rstrongBrian R. Bondy2015-03-26
|
* Bug 13439: No canvas prompt for content-callers.Gunes Acar2015-03-26
| | | | | | | | | | Both the Inspector and PDF.js raise canvas prompts although they are no danger as they are delivered with the browser itself and are no untrusted content. This patch exempts both of them from canvas prompts, too. If calling `DescribeScriptedCaller` fails neither `scriptFile` nor `scriptLine` are logged.
* Revert "Bug 762358 - Re-run configure when mozconfig changed in a ↵Georg Koppen2015-03-26
| | | | | | | | | | significant way. r=gps a=NPOTB" This reverts commit 87d09ba73a620931ffbe2576064aae55a961b097. It seems it breaks our deterministic build setup running |configure| again during |make build|. The former does not like being run under libfaketime but the latter needs to be in order to get reproducible builds.
* Bug 13742: Isolate cache to URL bar domain.Mike Perry2015-03-26
|
* Bug 13558: Allow download folder change on Win XP.Georg Koppen2015-03-26
| | | | | | | Changing the download folder on Win XP was crashing due to a mingw-w64 related Firefox bug. This is the backport of the fix provided in https://bugzilla.mozilla.org/show_bug.cgi?id=1091594. Thanks to Jacek Caban for the help.
* Bug 13594: Windows updater depends on msvcr100.dllKathy Brade2015-03-26
| | | | | | | | | | | | On Windows, updater.exe failed to start if a copy of msvcr100.dll was not installed in the system directory. We now append to the PATH the directory that contains our copy of msvcr100.dll; that is, the Browser/ directory that contains firefox.exe. That same directory contains a copy of libssp-0.dll, which updater.exe also depends on; both DLL dependencies are now satisfied from the Browser/ directory. Previously, the libssp-0.dll dependency was being satisifed from the .../Browser/TorBrowser/Tor directory which Tor Launcher adds to the path (and typically the updater is run from within a browser session or after a restart during which the PATH is preserved).
* It seems like we need to add one more path traversal for ESR31Tom Ritter2015-03-26
|
* Changes needed to build Mac in 64bitTom Ritter2015-03-26
|
* Bug #3455.2. Allow RFC1929 authentication (username/password) to SOCKS servers.Arthur Edelstein2015-03-26
|
* Bug #3455.1: Allow proxy settings to be set per URL bar domain.Arthur Edelstein2015-03-26
|
* Bug #11955 Backport certificate pinningCamilo Viecco2015-03-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes the following Mozilla patches, some modified for Tor Browser: Bug 744204 - Allow Key pining part 1 - Built-in Pinning Service. r=keeler Bug 744204 - Allow Certificate key pinning Part 2 - Certverifier Interface. r=keeler --HG-- extra : rebase_source : 2f9748ba0b241c697e22b7ff72f2f5a0fad4a2ca Bug 998057: Add test pinset to the pin generator (r=cviecco) --HG-- rename : security/manager/ssl/tests/unit/tlsserver/default-ee.der => security/manager/boot/src/default-ee.der Bug 998057: Add tests for certificate pinning (r=cviecco,dkeeler) Bug 1002696 - Minimum set of changes to make genHPKPStaticPins.js productionizable. r=cviecco, dkeeler --HG-- rename : security/manager/boot/src/PreloadedHPKPins.json => security/manager/tools/PreloadedHPKPins.json rename : security/manager/boot/src/genHPKPStaticPins.js => security/manager/tools/genHPKPStaticPins.js Bug 951315 - Add telemetry to PK pinning. r=dkeeler Bug 1006107 - Disable pining by default, setup pinning for *.addons.mozilla.org. r=dkeeler Tor project: only patching two files: security/manager/ssl/src/nsNSSComponent.cpp netwerk/base/public/security-prefs.js --HG-- extra : rebase_source : 93b1dbd5dc31490424060729a3941deffa8ee1d5 Bug 772756: Implement sha1 support, import Chrome's pinsets wholesale, add test mode (r=cviecco,keeler) Tor project, we only patch: security/manager/ssl/tests/unit/test_pinning.js security/manager/ssl/tests/unit/tlsserver/cmd/BadCertServer.cpp security/manager/ssl/tests/unit/tlsserver/default-ee.der security/manager/ssl/tests/unit/tlsserver/generate_certs.sh security/manager/ssl/tests/unit/tlsserver/other-test-ca.der security/manager/ssl/tests/unit/tlsserver/test-ca.der Bug 1009720: Telemetry for CERT_PINNING_TEST_RESULTS (r=keeler) Bug 1007844: Implement per-host telemetry for pin violations for AMO and aus4 (r=keeler) Only patching toolkit/components/telemetry/Histograms.json Bug 1011269: Add CertVerifier::pinningEnforceTestMode (r=keeler) Tor project, only commit: security/certverifier/CertVerifier.cpp security/certverifier/CertVerifier.h security/manager/ssl/src/nsNSSComponent.cpp Bug 1012882: Restrict pinning to desktop (r=keeler) Bug 1066190 (see: Tor Bug #13684) Tor Bug #11955: Backport certificate pinning Bring the following files up to date: security/manager/boot/src/PublicKeyPinningService.cpp security/manager/boot/src/PublicKeyPinningService.h security/manager/boot/src/StaticHPKPins.h security/manager/ssl/tests/unit/test_pinning.js security/manager/tools/PreloadedHPKPins.json security/manager/tools/genHPKPStaticPins.js security/pkix/include/pkix/Time.h security/pkix/lib/pkixtime.cpp
* Bug #5926: Allow JS locale to be set to English/C.Arthur Edelstein2015-03-26
| | | | See also https://trac.torproject.org/projects/tor/ticket/13019#comment:17
* Bug 13301: Avoid incompatible extensions prompt.Kathy Brade2015-03-26
| | | | | | | When updating via the background / timer-based check, the updater reported to the user that some extensions were incompatible (not true). The fix is to check extension compatibility against the platformVersion in a few more places (instead of against the appVersion, which is something like "4.0-alpha-3").
* Bug 13027: Backport of Navigator.* spoofing patch.Georg Koppen2015-03-26
| | | | | | | | | | | | It turned out Web Workers ignored general.*.override values which got fixed by Mozilla with https://hg.mozilla.org/mozilla-central/rev/b0b831a03d9ch https://hg.mozilla.org/mozilla-central/rev/eeb169601087 (bug 1062920 and 1060621). This is an ESR 31 specific backport which was at least partly necessary due to the big worker related patchset (bug 949325) which landed in Firefox 32.
* Bug 13016: Hide CSS -moz-osx-font-smoothing values.Kathy Brade2015-03-26
| | | | | | | | This patch prevents non-Chrome callers from using getComputedStyle() to retrieve values for the -moz-osx-font-smoothing CSS property. That property can be used to detect whether the preference layout.css.osx-font-smoothing.enabled is true of false (by default, it is true on Mac OS and false elsewhere).
* Bug 13356: symlinks missing after complete update.Kathy Brade2015-03-26
| | | | | | Include the symlink remove and add directives in the updatev2.manifest file that is used by 4.0-alpha-3 browsers (as well as in the updatev3.manifest file that is used by ESR31-based browsers).
* Bug 13025: Lie about screen orientation.Georg Koppen2015-03-26
| | | | | In a non-chrome context we give 'landscape-primary' back if asked about the screen orientation.
* Disable ICU when cross-compiling; clean-up.Georg Koppen2015-03-26
|
* Bug 973138 - Fixed goto crossing variable declaration (fixes GCC compilation).Jacek Caban2015-03-26
| | | | | --HG-- extra : rebase_source : 8b488731cb06cab3fc1e74e66f88046583e95fc2
* Bug 12811: WTypes.h -> wtypes.hGeorg Koppen2015-03-26
|
* Bug 12811: Fix for Mozilla's bug 1058778.Georg Koppen2015-03-26
| | | | | This is the fix for https://bugzilla.mozilla.org/show_bug.cgi?id=1058778 which breaks cross-compilation with mingw-w64.
* Bug 12811: Add MOZ_D3DCOMPILER_DLL iff available.Georg Koppen2015-03-26
| | | | | | | | | | | It seems MOZ_D3DCOMPILER_DLL is not avilable when compiling with mingw-w64. Trying to include it nevertheless breaks the packaging step as `@BINPATH@/@MOZ_D3DCOMPILER_DLL@` resolves to `bin/` which results in including all the things beginning with a `bin/` (again) which is treated as an error in case they got already included. This got fixed more or less by accident by bug 999260 which did not make it into ESR 31 (https://hg.mozilla.org/mozilla-central/rev/8b48386fc226).
generated by cgit v1.2.1 (git 2.18.0) at 2024-02-02 09:44:16 +0000