Paul Theriault [:pauljt] (no longer reading bugmail) Assignee
	Description • 13 years ago

Set current time. Timezone will go in the Settings API.

	Paul Theriault [:pauljt] (no longer reading bugmail) Assignee
	Comment 1 • 12 years ago

There is no time API, but I didnt just notice that there is a permission to set the clocktime in https://mxr.mozilla.org/mozilla-central/source/extensions/cookie/Permission.txt?raw=1

Hence I am leaving this as a P2 on the new scale.

	Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]
	Comment 2 • 12 years ago

please don't assign bugs to nobody, they show up in triage :)

	Paul Theriault [:pauljt] (no longer reading bugmail) Assignee
	Comment 3 • 11 years ago

This API is described here: https://developer.mozilla.org/en-US/docs/WebAPI/Time_and_Clock

It is very simple API which allows certified apps to change the system time. There are security implications of being able to change the time (e.g. certificates can be expired if the time is wrong). But the main mitigation here is that this is a certified permission (i.e. equiv of a privileged chrome API, only apps shipped with the device written by mozilla will use this permission).

The main threat with this API is that an app might be somehow be able to call this API without a permission. The api is called like this:

navigator.mozTime.set(time);

The permissions check can be seen in 
https://mxr.mozilla.org/mozilla-central/source/dom/base/Navigator.cpp#1489

1492 #ifdef MOZ_TIME_MANAGER
1493 NS_IMETHODIMP
1494 Navigator::GetMozTime(nsISupports** aTime)
1495 {
1496   *aTime = nullptr;
1497 
1498   NS_ENSURE_STATE(mWindow);
1499   if (!CheckPermission("time")) {
1500     return NS_ERROR_DOM_SECURITY_ERR;
1501   }
1502 
1503   if (!mTimeManager) {
1504     mTimeManager = new time::TimeManager(mWindow);
1505   }
1506 
1507   NS_ADDREF(*aTime = mTimeManager);
1508   return NS_OK;
1509 }
1510 #endif

So the permission check is made on the navigator.mozTime object - without the permission, a security error is thrown, and mozTime is null, as can be seen above.