Ticket #27271: 0001-Bug-27271-Don-t-allow-the-user-to-install-extensions.patch

File 0001-Bug-27271-Don-t-allow-the-user-to-install-extensions.patch, 997 bytes (added by igt0, 10 months ago)
  • mobile/android/app/000-tor-browser-android.js

    From 0e1543453cb541d08453154b2d13ce5cb93fa75c Mon Sep 17 00:00:00 2001
    From: Igor Oliveira <igt0@torproject.org>
    Date: Wed, 22 Aug 2018 15:51:32 -0300
    Subject: [PATCH] Bug 27271 -  Don't allow the user to install extensions from
     web
    
    An attacker can send a tampered torbutton extension to the user and
    TBA, currently, is not able to verify if the torbutton extension
    was built by Tor.
    ---
     mobile/android/app/000-tor-browser-android.js | 3 +++
     1 file changed, 3 insertions(+)
    
    diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js
    index 399c6f07718b..a2575b2cbe21 100644
    a b pref("general.useragent.updates.url", ""); 
    5656
    5757// Override this because Orbot uses 9050 as the default
    5858pref("network.proxy.socks_port", 9050);
     59
     60// Do not allow the user to install extensions from web
     61pref("xpinstall.enabled", false);