Search 1.0.3

Security, and the mouse wheel. Search 1.0.3 closes the holes found in this week's reviews — an extension could read files outside its own folder, and a page or an ad could open another app without asking — and copying a saved password now asks for Touch ID. A mouse wheel scrolls smoothly again on x.com and pages like it, Bitwarden signs in to a self-hosted server, and extension popups hear what changes while they are open. Also: History opens at once, music keeps playing when you switch spaces, a link from Mail brings Search to the front, a full-screen video no longer goes black, pop-ups need a click, and the tab bar folded away with ⌘S comes back on a ground of its own. Your extensions may each ask once more for their permissions at their next update.

Added

• Updates can wait for you: Settings › About › Install updates on its own, on as before. Switched off, Search still looks once a day and says when a newer version is out, and fetches, checks and installs it only when you press Install.

Fixed

• Security hardening across updates, extensions and the bench, from a careful private report — thanks to Vahagn Yengibaryan. An update is installed only if it meets the Developer ID requirement a shipped Search is signed to and matches its checksum; an extension's update is compared on everything it may do, the sites it reaches and the APIs Search answers for it included, and a package never supplies the files only Search writes beside it; an extension may request only permissions its manifest names, and reads browser settings or signs in only with the permission for it; and “Let a script drive Search” opens only once switched on in Settings.
• Bitwarden signs in to a self-hosted server. An extension's popup, and the page its "pop out" opens in a tab, now hear what changes while they are open: WebKit sent them no events at all, so Bitwarden's popup never learnt that its server had changed, and signed in to bitwarden.com, where a self-hosted account doesn't exist, until it was opened again.
• A mouse wheel scrolls pages that listen to the wheel themselves, as carousels and x.com do: Search stopped pages bouncing past their top and bottom with a style of its own, and together with such a listener WebKit dropped the wheel's steps. The bounce is now turned off by WebKit itself, the page's styles untouched, and the sideways bounce stays for swiping back and forward. Thanks @olllayor (#194). Fixes #180
• An account picked from the list under a sign-in field is filled only into the page it was offered for.
• History opens at once with a long past: with two thousand pages the panel took a third of a second to come up, and a second the first time, while it made every line at once and looked on disk for each site's icon. Now it makes only the lines in view, works out its days once, and remembers which sites have no icon. Escape already closes it (#70). (#67)
• A link clicked in Mail or any other app brings Search to the front, with the page, instead of opening it behind. (#95)
• The Web Inspector stays beside the page when the window changes size. Search took it out at the first resize and left the page shrunk next to an empty space. (#91)
• A certificate error is excused without a word only for this Mac itself (localhost, 127.x.x.x, ::1). Any other address, a router or a NAS on your network included, gets the usual warning, which you can pass for that site. Thanks @Dodothereal (#165) and @Hyp4tia for the report (#133)
• A user script an extension adds is read only from inside that extension's own package, and only for an extension that asked for userScripts. Thanks @burakbuilds (#198)
• A link to another app — Zoom, FaceTime, a file server — opens only from a click in the page itself, and Search asks first, as Safari does. Mail and phone links still open straight away on a click. Thanks @burakbuilds (#206)
• Copying a saved password asks who you are first, as showing one does. The copy is kept out of clipboard managers and cleared after 90 seconds. Thanks @burakbuilds (#203)
• Music, a video or a live stream keeps playing when you switch to another space, as it does in a tab you left; it used to stop. ⌘⇧M, or the tab's speaker, stops it. (#74)
• An extension from the Chrome Web Store is fetched again only when the store has a newer version. The daily check read the first version="" in the store's reply, which is the XML declaration's "1.0", so every extension counted as out of date: each was downloaded again (uBlock Origin Lite is nearly 10 MB), unloaded and reloaded about once a day, and a password manager signed out with it. Thanks @burakbuilds (#201)
• A password kept from an https page is no longer offered on a plain http page of the same site, where anyone on the network in between — a café's, a hotel's — could have put the sign-in form there. Search now notes whether a password was saved over http or https, as Chrome does, and an http page is offered only the ones kept from http: a router's page still gets its own. A password saved before this is taken as https until it is next used on an http page. Thanks @burakbuilds (#205)
• Saving or removing a password touches only Search's own entry in the keychain. Both looked an entry up by site and account alone, which also found what another app keeps for the same site: git's token for github.com under your username, for one. Saving your GitHub password in Search wrote it over that token once the keychain was allowed to, and removing it deleted the token. Search's entries are now also marked as a web form's, so one can sit beside another app's for the same site. Thanks @burakbuilds (#208)
• A page opens a new tab of its own only from a click or a key, as in Safari. WebKit on the Mac lets a page call window.open whenever it likes, and Search took you to each one: a page could open tabs on load or on a timer and pull you away from the one you were reading. A sign-in or share window opened by its button opens as before. Thanks @burakbuilds (#207)
• An extension loaded from a folder asks again when Reload finds it wants more than you agreed to, the same question an update already asks, and keeps the version you had if you say no; Reload used to take the new access without asking. Thanks @karadoganyi (#161), and @Hyp4tia for the report (#135)
• The tab bar folded away with ⌘S comes back over the page on a ground of its own, as the column does: the page no longer shows through between the tabs, and its shadow falls along the bar's edge instead of from every title and icon.
• ⌘W no longer bounces between two pins: with only pins open, putting down the last one awake leaves an empty tab instead of waking the other again. Thanks @armin-ahmadii (#125)
• History keeps two articles or two videos of the same site apart: an address's query (?id=, ?v=) is part of what makes it a page of its own, so the second Hacker News story or YouTube video you open no longer takes the first one's place. Thanks @yuxino (#154)
• A video put full screen, on YouTube and the like, fills the screen with its picture rather than black with the sound playing on. Thanks @StefanTodorov32 (#220)
• The back, forward and reload buttons have a little room between them. Thanks @DagimAlemayehuu (#209), and @olllayor for asking (#185)