Closed Bug 814153 Opened 12 years ago Closed 12 years ago

Need additional security checks for the "settings" permission

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla20
blocking-basecamp +
Tracking Status
firefox18 --- fixed
firefox19 --- fixed
firefox20 --- fixed

People

(Reporter: bent.mozilla, Assigned: gwagner)

References

Details

Attachments

(1 file)

Notes from conversation with gregor:

settings:
  settings-read and settings-write both checked in child for dom access, but returns non-null if access not granted (logs error to console only)
  doesn't assert permission before adding listeners ("Settings:RegisterForMessages")

We should tighten this up a little.
blocking-basecamp: ? → +
Gregor, Doug said you should be the lucky owner of this bug.  Congrats!  :)
Assignee: nobody → anygregor
Attached patch patch (deleted) — Splinter Review
(In reply to ben turner [:bent] from comment #0)
> Notes from conversation with gregor:
> 
> settings:
>   settings-read and settings-write both checked in child for dom access, but
> returns non-null if access not granted (logs error to console only)

fixed by 815398

>   doesn't assert permission before adding listeners
> ("Settings:RegisterForMessages")

This patch
Attachment #686625 - Flags: review?(bent.mozilla)
Attachment #686625 - Flags: review?(bent.mozilla) → review+
https://hg.mozilla.org/mozilla-central/rev/a242c45cc80b
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: