summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Bug 15933: Isolate by base (top-level) domain name.bug15933Mike Perry2015-05-07
| | | | | TLD isolation is needed for file hosting sites, and sites with lots of subdomains.
* fixup! Bug #3455.2. Allow RFC1929 authentication (username/password) to ↵Nicolas Vigier2015-05-06
| | | | | | | SOCKS servers. Remove unused variables proxyHost and proxyPort to fix unused-but-set-variable build errors.
* fixup! Bug #3455.1: Allow proxy settings to be set per URL bar domain.Nicolas Vigier2015-05-06
| | | | | | | | Fix reorder build error: ../../../dist/include/mozilla/net/HttpBaseChannel.h:339:11: error: 'mozilla::net::HttpBaseChannel::mRedirectCount' will be initialized after [-Werror=reorder] ../../../dist/include/mozilla/net/HttpBaseChannel.h:327:20: error: 'nsCOMPtr<nsIURI> mozilla::net::HttpBaseChannel::mProxyURI' [-Werror=reorder] /builds/slave/try-l64-d-00000000000000000000/build/src/netwerk/protocol/http/HttpBaseChannel.cpp:39:1: error: when initialized here [-Werror=reorder]
* Bug 15857: Fix file descriptor leak in updater.Mike Perry2015-05-06
| | | | | Corresponds to Mozilla bug https://bugzilla.mozilla.org/show_bug.cgi?id=1159826.
* Merge remote-tracking branch 'arthur/15899' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-05-06
|\
| * fixup! Bug #15502. Isolate blob URLs to first party; no blobURLs in Web WorkersArthur Edelstein2015-05-01
| |
* | fixup! Bug 12827: Create preference to disable SVG.Kathy Brade2015-04-24
|/ | | | | | During parsing, avoid dereferencing null pointers when script and style elements are created as generic elements (i.e., when svg.in-content.enabled=false). Fixes ticket #15794.
* Merge remote-tracking branch 'arthur/15502+8' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-21
|\
| * Bug #15502, Part 2: Regression tests for blob URL isolationArthur Edelstein2015-04-21
| |
| * Bug #15502. Isolate blob URLs to first party; no blobURLs in Web WorkersArthur Edelstein2015-04-21
| |
* | Merge remote-tracking branch 'gk/bug_15758' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-21
|\ \ | | | | | | | | | | | | Conflicts: browser/app/profile/000-tor-browser.js
| * | fixup! TB4: Tor Browser's Firefox preference overrides.Georg Koppen2015-04-21
| | |
* | | Merge remote-tracking branch 'gk/bug_15757' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-21
|\ \ \ | |_|/ |/| |
| * | fixup! TB4: Tor Browser's Firefox preference overrides.Georg Koppen2015-04-21
| |/
* | Bug 14716: HTTP Basic Authentication prompt only displayed onceKathy Brade2015-04-17
|/ | | | | Modify the login manager implementation to handle the situation where storage is not available.
* Merge remote-tracking branch 'gk/bug_10761_v2' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-15
|\
| * Bug 10761: Fix shutdown crashes on WindowsGeorg Koppen2015-04-14
| | | | | | | | | | | | | | Jacek Caban gave us this patch which should fix the shutdown crashes on Windows (#10761 and #14454) as newer GCC/Binutils versions do not need the workaround anymore that got implemented back then in https://bugzilla.mozilla.org/show_bug.cgi?id=337887.
* | Revert "TB1: Add a string-based cacheKey."Mike Perry2015-04-15
| | | | | | | | | | | | This reverts commit 53f8f2506cb21bf1847a4261ef383db9be55a93c. This used to be used by Torbutton/SafeCache, but we moved the cache isolation to direct C++ patches instead.
* | Merge remote-tracking branch 'arthur/13875' into tor-browser-31.6.0esr-4.5-1Mike Perry2015-04-15
|\ \
| * | fixup! Bug #5856: Do not expose physical screen info via window & window.screen.Arthur Edelstein2015-04-08
| | |
* | | fixup! TB4: Tor Browser's Firefox preference overrides.Georg Koppen2015-04-14
| | | | | | | | | | | | | | | We remove the keep-alive restriction now that we have isolation to the URL bar domain which is governing this as well (see: bug 4100).
* | | fixup! Bug #3455.2. Allow RFC1929 authentication (username/password) to ↵Georg Koppen2015-04-14
|/ / | | | | | | SOCKS servers.
* | fixup! TB4: Tor Browser's Firefox preference overrides.Arthur Edelstein2015-04-02
|/
* Bug 10895: Fix versioning for langpacks.Mike Perry2015-03-26
|
* Bug 10280: Don't load any plugins into the address space.Mike Perry2015-03-26
| | | | | | | | | If the pref "plugin.disable" is set, the user has to click an extra button to cause Firefox to actually scan the filesystem for plugins. Note: The strings for this patch are actually present in Torbutton. Patch by 'disgleirio'.
* Bug 15406: Only include forced updates if extensions differ.Kathy Brade2015-03-26
| | | | | | | | | For the NoScript and HTTPS Everywhere extensions, only force files to be included in incremental MARs if the extension has changed. For NoScript we detect this by comparing the old and new .xpi files. For HTTPS Everywhere (which is unpacked) we only check install.rdf; our assumption is that the version number will be changed for each new release.
* Bug 15406: Do not force updates for Torbutton and Tor Launcher.Kathy Brade2015-03-26
| | | | | | | | | | Since we have disabled updates for Torbutton and Tor Launcher, there is no need to force these extensions to be updated (replaced) when generating our incremental MAR files. Also, we no longer force an update to the pdf.js extension (it is now built into the browser) or to the firefox binary on Mac OS (Mozilla forces firefox to be replaced on Mac OS due to code signing / signature issues with partner builds; see https://bugzilla.mozilla.org/show_bug.cgi?id=770996).
* Bug 13548: Create preference to disable MathML.Kathy Brade2015-03-26
| | | | | If the mathml.disabled preference is true, treat <math> and other MathML elements as generic XML elements.
* Bug 12827: Create preference to disable SVG.Kathy Brade2015-03-26
| | | | | | | | | | | | | | | If the svg.in-content.enabled preference is false, disallow all use of SVG within content pages. In the following situations it is very difficult to determine if code is executing within a chrome context or not: SVG hasFeature() API. SVG hasExtension() API. Use of SVG glyphs within custom OpenType fonts. In these cases, everything is assumed to be content; that is, setting the pref. to false will block use of the above features from chrome as well. This is OK because these features are unlikely to be used by core browser code.
* Bug 15201: Windows: disable "runas" code path in updater.Kathy Brade2015-03-26
| | | | | | Instead of using "runas" to try to elevate privileges, the updater now fails if the user does not have permission to apply an update. This avoids potential security issues such as CVE-2015-0833.
* Bug 14631: Improve profile access error msgs (strings).Kathy Brade2015-03-26
| | | | | To allow for localization, get profile-related error strings from Torbutton. Use app display name ("Tor Browser") in profile-related error alerts.
* Bug 14631: Improve profile access error messages.Kathy Brade2015-03-26
| | | | | Instead of always reporting that the profile is locked, display specific messages for "access denied" and "read-only file system".
* Bug 13900: Remove 3rd party HTTP auth tokens.Kathy Brade2015-03-26
| | | | | | | | Prevent user tracking via HTTP Basic Authentication by removing Authorization headers from third party requests. This is a port of a piece of the Stanford SafeCache code that previously was included in Torbutton.
* Bug 14392: Make about:tor behave like other initial pages.Mike Perry2015-03-26
|
* Bug 12430: Disable external jar: via preferenceGeorg Koppen2015-03-26
| | | | | | This is a patch written by Jeff Gibat (iSECPartners) to disable the jar: protocol handler via a preference. The preference is bound to the security slider settings (#9387).
* Bug #13749.2: Regression tests for first-party isolation of cacheArthur Edelstein2015-03-26
| | | | | | | | | | | | | This test ensures that if first-party isolation is enabled ("privacy.thirdparty.isolate" pref is set to 2) then when a loaded file is cached, it is indexed by the URL-bar domain. In this test, a number of files are loaded (via IFRAME, LINK, SCRIPT, IMG, OBJECT, EMBED, AUDIO, VIDEO, TRACK and XMLHttpRequest) by parent pages with different URL bar domains. When isolation is active, we test to confirm that a separate copy of each file is cached for each different parent domain. We also test to make sure that when isolation is inactive, a single copy of the child page is cached and reused for all parent domains.
* Bug #13749.1: regression tests for first party isolation of localStorageArthur Edelstein2015-03-26
|
* Bug 13379: Adding our MAR signing keys.Georg Koppen2015-03-26
|
* Bug 13379: Sign our MAR files.Kathy Brade2015-03-26
| | | | | | | | | | | | | | | | | Configure with --enable-signmar (build the signmar tool). Configure with --enable-verify-mar (when updating, require a valid signature on the MAR file before it is applied). Use the Tor Browser version instead of the Firefox version inside the MAR file info block (necessary to prevent downgrade attacks). Use NSS on all platforms for checking MAR signatures (Mozilla plans to use OS-native APIs on Mac OS and they already do so on Windows). So that the NSS and NSPR libraries the updater depends on can be found at runtime, we add the firefox directory to the shared library search path on all platforms. Use SHA512-based MAR signatures instead of the SHA1-based ones that Mozilla uses. This is implemented inside MAR_USE_SHA512_RSA_SIG #ifdef's and with a signature algorithm ID of 512 to help avoid collisions with future work Mozilla might do in this area. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1105689
* Bug 13379: Sign our MAR files (backport Mozilla patches).Kathy Brade2015-03-26
| | | | | | | | Backport reviewed patches from these two Mozilla bugs: 903135 - Link updater to NSS and enable MAR verification on Linux and OSX 903126 - Implement a platform independent way to determine which cert to use for verifying mars Configure browser build with --enable-signmar and --enable-verify-mar.
* Bug 902761 - Stop storing certs used for MAR verification in EXE resource ↵Brian R. Bondy2015-03-26
| | | | files. r=rstrong
* Bug 902761 - Build configuration for turning .der files into .h files. r=rstrongBrian R. Bondy2015-03-26
|
* Bug 13439: No canvas prompt for content-callers.Gunes Acar2015-03-26
| | | | | | | | | | Both the Inspector and PDF.js raise canvas prompts although they are no danger as they are delivered with the browser itself and are no untrusted content. This patch exempts both of them from canvas prompts, too. If calling `DescribeScriptedCaller` fails neither `scriptFile` nor `scriptLine` are logged.
* Revert "Bug 762358 - Re-run configure when mozconfig changed in a ↵Georg Koppen2015-03-26
| | | | | | | | | | significant way. r=gps a=NPOTB" This reverts commit 87d09ba73a620931ffbe2576064aae55a961b097. It seems it breaks our deterministic build setup running |configure| again during |make build|. The former does not like being run under libfaketime but the latter needs to be in order to get reproducible builds.
* Bug 13742: Isolate cache to URL bar domain.Mike Perry2015-03-26
|
* Bug 13558: Allow download folder change on Win XP.Georg Koppen2015-03-26
| | | | | | | Changing the download folder on Win XP was crashing due to a mingw-w64 related Firefox bug. This is the backport of the fix provided in https://bugzilla.mozilla.org/show_bug.cgi?id=1091594. Thanks to Jacek Caban for the help.
* Bug 13594: Windows updater depends on msvcr100.dllKathy Brade2015-03-26
| | | | | | | | | | | | On Windows, updater.exe failed to start if a copy of msvcr100.dll was not installed in the system directory. We now append to the PATH the directory that contains our copy of msvcr100.dll; that is, the Browser/ directory that contains firefox.exe. That same directory contains a copy of libssp-0.dll, which updater.exe also depends on; both DLL dependencies are now satisfied from the Browser/ directory. Previously, the libssp-0.dll dependency was being satisifed from the .../Browser/TorBrowser/Tor directory which Tor Launcher adds to the path (and typically the updater is run from within a browser session or after a restart during which the PATH is preserved).
* It seems like we need to add one more path traversal for ESR31Tom Ritter2015-03-26
|
* Changes needed to build Mac in 64bitTom Ritter2015-03-26
|
* Bug #3455.2. Allow RFC1929 authentication (username/password) to SOCKS servers.Arthur Edelstein2015-03-26
|
generated by cgit v1.2.1 (git 2.18.0) at 2024-02-02 09:44:07 +0000