With the current plan to harden the security of Firefox, we want to disallow internal privileged pages to use inline JavaScript. Since their amount is fairly limited, we start this by rewriting them bit by bit.

Hi, I'd like to pick this one up as my first ticket. I guess I'm facing a similar issue to others on the various sub-parts though in that I can't seem to find anyway to assign it to myself to prevent duplicate efforts.

patch for separating out the inline js previously found in aboutFeedback.

Comment on attachment 8355010 [details] [diff] [review] bug948897.patch Thanks! If you're ready for this patch to land, you can follow the instructions here and add "checkin-needed" to the "Keywords" field of this bug: https://developer.mozilla.org/en-US/docs/Creating_a_patch_that_can_be_checked_in

Hi, I think I maybe lack the required edit bug privileges to add the 'checkin-needed' flag for this. Not sure where to go from here, do I need to ask someone else to do something further with this?

Thank you for working on this patch, Neil. Neil, please change the patch so that it can be checked in (see Matt's link), I think you mostly need the r=mbrubeck part, if I'm not mistaken. After that you should be able to add "checkin-needed" in the Keyword field. If not, please ping again and I will do so for your.

As a follow-up, we should also file a bug to remove the inline onload/onunload/onclick/onsubmit calls in aboutFeedback.xhtml, and use JS event listeners instead.

(In reply to :Margaret Leibovic from comment #7) > As a follow-up, we should also file a bug to remove the inline > onload/onunload/onclick/onsubmit calls in aboutFeedback.xhtml, and use JS > event listeners instead. Oh, thanks for pointing that out! :) I have filed bug 957052 to track this.

Fixed = on m-c. Please don't resolve bugs if they haven't landed there yet.