Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
Trac
Trac
  • Project overview
    • Project overview
    • Details
    • Activity
  • Issues 246
    • Issues 246
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Operations
    • Operations
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value Stream
  • Wiki
    • Wiki
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Create a new issue
  • Issue Boards

GitLab is used only for code review, issue tracking and project management. Canonical locations for source code are still https://gitweb.torproject.org/ https://git.torproject.org/ and git-rw.torproject.org.

  • Legacy
  • TracTrac
  • Issues
  • #10682

Closed
Open
Opened Jan 21, 2014 by Mike Perry@mikeperry

Disable update pings for Torbutton and Tor Launcher

Bobnomnom reports that it is currently possible to hijack addon updates of Torbutton and TorLauncher by submitting a fake version to addons.mozilla.org with a matching addon uid. Because both of these addons lack an update url, they both still ping addons.mozilla.org for updates to their addon ID. Mozilla reviewers might catch an attempt by a rogue addon upload that is trying to steal our ID and do bad things, but then again they might not.

It used to be possible to disable individual addon updates by creating a pref for extensions.{id}.updates.enabled, but I think this has now changed. There still is a mechanism for it though. The addons UI has a "More..." link for each addon that opens a pane where you can click a radio button to disable updates for that addon. It does not appear to set any prefs though.

We need to investigate what this UI is doing now and set the equivalent value somehow ourselves.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: legacy/trac#10682