Disable Heartbeat prompts in Tor Browser

https://bugzilla.mozilla.org/show_bug.cgi?id=1196104 implements Heartbeat prompts for PBM. We should make sure this is disabled to not confuse our users.

added TorBrowserTeam201605R component::applications/tor browser ff45-esr owner::tbb-team priority::medium resolution::fixed severity::normal status::closed tbb-6.0-must type::task labels

Trac:
Cc: N/A to arthuredelstein

Trac:
Keywords: N/A deleted, tbb-6.0-must added

We already set browser.selfsupport.enabled = false in browser/app/profile/000-tor-browser.js, and Kathy and I believe that is enough to disable the Heartbeat feature for both regular and private windows. If we want to be doubly sure we could also set browser.selfsupport.url to an empty string.

Kathy and I definitely believe that we should also set browser.uitour.enabled = false. Doing so will disable a bunch of code that allows remote pages to manipulate the browser UI (in a limited way, assuming no bugs). Maybe that deserves its own ticket. But in ticket:18886#comment:16, Arthur wrote:

I haven't modified the UITour code as we are already suppressing the UITour itself.

Arthur, how are we suppressing the UITour?

Trac:
Status: new to needs_information

Replying to mcs:

We already set browser.selfsupport.enabled = false in browser/app/profile/000-tor-browser.js, and Kathy and I believe that is enough to disable the Heartbeat feature for both regular and private windows. If we want to be doubly sure we could also set browser.selfsupport.url to an empty string.

Kathy and I definitely believe that we should also set browser.uitour.enabled = false. Doing so will disable a bunch of code that allows remote pages to manipulate the browser UI (in a limited way, assuming no bugs). Maybe that deserves its own ticket. But in ticket:18886#comment:16, Arthur wrote:

I haven't modified the UITour code as we are already suppressing the UITour itself.

Arthur, how are we suppressing the UITour?

In our torbutton patch for #18905 (moved) we remove the "[BrowserName] Tour" menu item from the help menu. But I agree we should also set "browser.uitour.enabled" to false.

The sites that have permission to invoke the UITour functionality are listed in browser/app/permissions.

Here is a patch that disables the UITour backend and also sets browser.selfsupport.url to "" for good measure: https://gitweb.torproject.org/user/brade/tor-browser.git/commit/?h=bug19047-01&id=0651282ea94c4dddcec724f0ea6c21aecfd6b942

Please review.

Trac:
Status: needs_information to needs_review
Keywords: TorBrowserTeam201605 deleted, TorBrowserTeam201605R added

Looks good to me.

Thanks, commit 0651282ea94c4dddcec724f0ea6c21aecfd6b942 on tor-browser-45.1.0esr-6.0-1 has the fix applied.

Trac:
Status: needs_review to closed
Resolution: N/A to fixed

closed

mentioned in issue #27082 (moved)

mentioned in issue #30732 (moved)

moved to tpo/applications/tor-browser#19047 (closed)

mentioned in issue tpo/applications/tor-browser#27082 (closed)