Opened 6 weeks ago

Closed 5 weeks ago

Last modified 4 weeks ago

#31601 closed defect (fixed)

Don't let Mozilla recommend extensions again

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: TorBrowserTeam201909R, tbb-9.0-must-alpha, ff68-esr
Cc: Actual Points: 0.2
Parent ID: Points: 0.25
Reviewer: Sponsor:

Description

It seems we need to ramp up our defense against the threat in #22899 again with ESR 68 as our users are getting shown recommended extensions again.

Child Tickets

Change History (8)

comment:1 Changed 6 weeks ago by gk

Points: 0.25

comment:2 Changed 6 weeks ago by gk

Component: - Select a componentApplications/Tor Browser
Owner: set to tbb-team

comment:3 Changed 6 weeks ago by gk

Keywords: ff68-esr added

comment:4 Changed 6 weeks ago by Thorin

All new prefs added in FF68

user_pref("extensions.getAddons.discovery.api_url", "");
user_pref("extensions.htmlaboutaddons.discover.enabled", false);
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);

This disables recommendations in about:addons' Extensions and Themes panes and removes/hides any leftover UI bits and bobs

comment:5 Changed 5 weeks ago by acat

Keywords: TorBrowserTeam201909R added; TorBrowserTeam201909 removed
Status: newneeds_review

Thanks. I think extensions.htmlaboutaddons.recommendations.enabled is enough.

extensions.htmlaboutaddons.discover.enabled is used in https://searchfox.org/mozilla-esr68/source/toolkit/mozapps/extensions/content/extensions.js#854, but the old extensions.getAddons.showPane should cover that.

Patch for review: https://www.github.com/acatarineu/tor-browser/commit/31601.

comment:6 Changed 5 weeks ago by gk

Resolution: fixed
Status: needs_reviewclosed

Looks good. Cherry-picked onto tor-browser-68.1.0esr-9.0-2 (commit e489c5048b762b3226db23b6ea9ffc440617615e).

comment:7 in reply to:  5 Changed 5 weeks ago by Thorin

Replying to acat:

Thanks. I think extensions.htmlaboutaddons.recommendations.enabled is enough.

Yes. Sorry about that. the .enabled pref wasn't added until after 68.0b9 and I already had the other two pegged (because I'm that efficient!). They are indeed redundant

comment:8 Changed 4 weeks ago by acat

Actual Points: 0.2
Note: See TracTickets for help on using tickets.