Load page A (say, a hotmail page that has user information encoded into the URL). Enter the URL of page B (say, http://www.evil-hackers.com/) and load the page. The URL of the previously displayed page gets sent to evil-hackers.com, a clear security hole. Solution: when a new URL is entered into the netsite: line and loaded, clear the Referer: field. After all, there is no logical relationship between the old page and the new one, so no reason to send the referer:

Thanks for the reminder. I had fixed this bug in 4.06 but forgot to merge the change into Mozilla. It should show up in the next build after 9/4.

Greg -- please verify -- thanks

As far as I can tell using a simple sample test case this appears to work properly with Jan 29 build of Seamonkey on Mac.

changed summary for clarity.

You really want to be reviewing MozillaClassic bugs? This one is definitely specific to the old Mac only FE code

sdagley: gotta get my testcase from somewhere :)

the refer logging for the testcase in the URL field is at: http://www.packetgram.com/pktg/mozilla/bugzilla/83038/referlog.txt