Opened 4 years ago

Closed 4 years ago

#19047 closed task (fixed)

Disable Heartbeat prompts in Tor Browser

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ff45-esr, TorBrowserTeam201605R, tbb-6.0-must
Cc: arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

https://bugzilla.mozilla.org/show_bug.cgi?id=1196104 implements Heartbeat prompts for PBM. We should make sure this is disabled to not confuse our users.

Child Tickets

Change History (7)

comment:1 Changed 4 years ago by arthuredelstein

Cc: arthuredelstein added

comment:2 Changed 4 years ago by gk

Keywords: tbb-6.0-must added

comment:3 Changed 4 years ago by mcs

Status: newneeds_information

We already set browser.selfsupport.enabled = false in browser/app/profile/000-tor-browser.js, and Kathy and I believe that is enough to disable the Heartbeat feature for both regular and private windows. If we want to be doubly sure we could also set browser.selfsupport.url to an empty string.

Kathy and I definitely believe that we should also set browser.uitour.enabled = false. Doing so will disable a bunch of code that allows remote pages to manipulate the browser UI (in a limited way, assuming no bugs). Maybe that deserves its own ticket. But in ticket:18886#comment:16, Arthur wrote:

I haven't modified the UITour code as we are already suppressing the UITour itself.

Arthur, how are we suppressing the UITour?

comment:4 in reply to:  3 Changed 4 years ago by arthuredelstein

Replying to mcs:

We already set browser.selfsupport.enabled = false in browser/app/profile/000-tor-browser.js, and Kathy and I believe that is enough to disable the Heartbeat feature for both regular and private windows. If we want to be doubly sure we could also set browser.selfsupport.url to an empty string.

Kathy and I definitely believe that we should also set browser.uitour.enabled = false. Doing so will disable a bunch of code that allows remote pages to manipulate the browser UI (in a limited way, assuming no bugs). Maybe that deserves its own ticket. But in ticket:18886#comment:16, Arthur wrote:

I haven't modified the UITour code as we are already suppressing the UITour itself.

Arthur, how are we suppressing the UITour?

In our torbutton patch for #18905 we remove the "[BrowserName] Tour" menu item from the help menu. But I agree we should also set "browser.uitour.enabled" to false.

comment:5 Changed 4 years ago by mcs

Keywords: TorBrowserTeam201605R added; TorBrowserTeam201605 removed
Status: needs_informationneeds_review

The sites that have permission to invoke the UITour functionality are listed in browser/app/permissions.

Here is a patch that disables the UITour backend and also sets browser.selfsupport.url to "" for good measure:
https://gitweb.torproject.org/user/brade/tor-browser.git/commit/?h=bug19047-01&id=0651282ea94c4dddcec724f0ea6c21aecfd6b942

Please review.

comment:6 Changed 4 years ago by arthuredelstein

Looks good to me.

comment:7 Changed 4 years ago by gk

Resolution: fixed
Status: needs_reviewclosed

Thanks, commit 0651282ea94c4dddcec724f0ea6c21aecfd6b942 on tor-browser-45.1.0esr-6.0-1 has the fix applied.

Note: See TracTickets for help on using tickets.