Commit 112aea33 authored by Igor Oliveira's avatar Igor Oliveira Committed by Georg Koppen
Browse files

Bug 27271 - Don't allow the user to install extensions from web 

An attacker can send a tampered torbutton extension to the user and
TBA, currently, is not able to verify if the torbutton extension
was built by Tor.
parent f0049aaf

mobile/android/app/000-tor-browser-android.js

+5 −0
Original line number Diff line number Diff line
@@ -56,3 +56,8 @@ pref("general.useragent.updates.url", ""); 


// Override this because Orbot uses 9050 as the default

pref("network.proxy.socks_port", 9050);



// Do not allow the user to install extensions from web

pref("xpinstall.enabled", false);

pref("extensions.enabledScopes", 1);

pref("extensions.autoDisableScopes", 1);