arthuredelstein / tor-browser Public

Bug 18884: Disable Loop extension

When a mozconfig file contains
  ac_add_options --disable-loop

then the Loop extension will not be built or bundled with the browser.

Set the heartbeat URL to an empty string as a defense in depth measure
and disable the UITour backend (bug 19047).

…g in KeyboardEvent

…ents

If the user toggles the value of "browser.pocket.enabled", then menu
items (and pocket button) will be affected only after browser restart.

Disable monitoring the connected state of Tor Browser users (bug 18945).

…to clean it. r=mossop

--HG--
extra : rebase_source : 44545607f4434a8ad03cdc59306e02517056d42c

When SVGs are disabled, do no load SVG images within the
Page Info Media tab (bug 18770).

… via window & window.screen.

Make sure that
screen.orientation.angle -> 0 and
screen.orientation.type -> "landscape-primary"

Also refactors screen.mozOrientation.

…ate browsing

Ignore the XRE_PROFILE_PATH environment variable during the
restart that occurs immediately after updating from a version
of Tor Browser that uses an embedded profile (fixes bug 18928).

This fixes the isolation issues on the Page Info dialog (both video and
audio related). See bug 18703 for more details.

Avoid special handling and use of "add-if" for unpacked add-ons
that are located under distribution/extensions (fixes bug #18951).

Disable Pocket feature (bug 18886)

Revert "Bug 1159090 - Only append library path for updater if it is a unique value. r=rstrong"

This reverts commit 5c4fcaf.

…ache

Also tests for isolation of WorkerGlobalScope.importScripts()
https://bugs.torproject.org/18890

There should be no need to remove the OS X support introduced in
https://bugzilla.mozilla.org/show_bug.cgi?id=1225726 as enabling this
is governed by a preference (which is actually set to `false`). However,
we remove it at build time as well (defense in depth).

This is basically a backout of the relevant passages of
https://hg.mozilla.org/mozilla-central/rev/6bfb430de85d,
https://hg.mozilla.org/mozilla-central/rev/609b337bf7ab and
https://hg.mozilla.org/mozilla-central/rev/8e092ec5fbbd.

Instead of using the local computer's IP address within
symlink-based profile lock signatures, always use 127.0.0.1.

This patch fixes bug 16874 and 18767 as well.

Mozilla introduced extension signing as a way to make it harder for an
attacker to get a malicious add-on running in a user's browser. See:
https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience
and https://blog.mozilla.org/addons/2016/01/22/add-on-signing-update/
for some background information.

In ESR45 this feature is enabled by default and we exempt both our own
extensions and EFF's HTTPS-Everywhere from this requirement.

Ensure that the tickler is always stubbed out, even on
Android (e.g., for Orfox).

Restore the portion of this fix that was not upstreamed as part of
https://bugzilla.mozilla.org/show_bug.cgi?id=232227: use properly
contrasting colors if the desktop theme specifies white on black
for text colors (see bug 7920). These color choices are not exposed
to content.

Backported for Tor Browser

The hardened Tor Browser based on ESR45 is working fine again without
disabling the startup cache. We should enable it again even if the
performance win is probably minor.

Add an --enable-tor-browser-data-outside-app-dir configure option.
When this is enabled, all user data is stored in a directory named
TorBrowser-Data which is located next to the application directory.

The first time an updated browser is opened, migrate the existing
browser profile, Tor data directory contents, and UpdateInfo to the
TorBrowser-Data directory. If migration of the browser profile
fails, an error alert is displayed and the browser is started
using a new profile.

Display an informative error messages if the TorBrowser-Data
directory cannot be created due to an "access denied" or a
"read only volume" error.

Add support for installing "override" preferences within the user's
browser profile. All .js files in distribution/preferences (on
Mac OS, Contents/Resources/distribution/preferences) will be copied
to the preferences directory within the user's browser profile when
the profile is created and each time Tor Browser is updated. This
mechanism will be used to install the extension-overrides.js file
into the profile.

On Mac OS, add support for the --invisible command line option which
is used by the meek-http-helper to avoid showing an icon for the
helper browser on the dock.

Temporarily disable staged updates on Windows.

Add an about:tbupdate page that displays the first section from
TorBrowser/Docs/ChangeLog.txt and includes a link to the remote
post-update page (typically our blog entry for the release).