wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-06 15:58:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

[Pale-Moon] Warn before using external handler for usenet protocols

Browse source 
We normally ask for confirmation before asking the operating system to
find an application to handle a scheme that the browser does not support.

It did not ask before doing so for the Usenet-related schemes news: snews:
and nntp:. Since most operating systems in 2024 don't have a trusted
newsreader installed by default, an unscrupulous program that the user
downloaded could register itself as a handler.
The website that served the application download could then launch that
application at will. Of course, all bets are off if a user runs such a
program to begin with, but in some situations (looking at you, MacOS!)
just downloading/unpacking could already result in registration as a
protocol handler without the user actually executing anything.
This commit is contained in:
Moonchild 2024-09-04 13:59:25 +02:00 • committed by roytam1
commit d004b26d7f
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
application/palemoon/app/profile/palemoon.js
View file

@ -625,7 +625,7 @@ pref("browser.xul.error_pages.expert_bad_cert", false);
// Work Offline is best manually managed by the user.
pref("network.manage-offline-status", false);
// We want to make sure mail URLs are handled externally...
// We want to make sure known external protocol URLs are handled externally.
pref("network.protocol-handler.external.mailto", true); // for mail
pref("network.protocol-handler.external.news", true); // for news
pref("network.protocol-handler.external.snews", true); // for secure news
@ -634,11 +634,11 @@ pref("network.protocol-handler.external.nntp", true); // also news
pref("network.protocol-handler.external.ms-windows-store", true);
#endif
// ...without warning dialogs
// Configure external handler warning dialogs.
pref("network.protocol-handler.warn-external.mailto", false);
pref("network.protocol-handler.warn-external.news", false);
pref("network.protocol-handler.warn-external.snews", false);
pref("network.protocol-handler.warn-external.nntp", false);
pref("network.protocol-handler.warn-external.news", true);
pref("network.protocol-handler.warn-external.snews", true);
pref("network.protocol-handler.warn-external.nntp", true);
#ifdef XP_WIN
pref("network.protocol-handler.warn-external.ms-windows-store", false);
#endif