Bug 11641: Disable remoting by default.

Unless the -osint command line flag is used, the browser now defaults
to the equivalent of -no-remote.  There is a new -allow-remote flag that
may be used to restore the original (Firefox-like) default behavior.

toolkit/xre/nsAppRunner.cpp

@@ -2108,8 +2108,10 @@ static void DumpHelp() {
       "  --migration        Start with migration wizard.\n"
       "  --ProfileManager   Start with ProfileManager.\n"
 #ifdef MOZ_HAS_REMOTE
-      "  --no-remote        Do not accept or send remote commands; implies\n"
+      "  --no-remote        (default) Do not accept or send remote commands; "
+      "implies\n"
       "                     --new-instance.\n"
+      "  --allow-remote     Accept and send remote commands.\n"
       "  --new-instance     Open new instance, not a new window in running "
       "instance.\n"
 #endif
@@ -4353,17 +4355,21 @@ int XREMain::XRE_mainInit(bool* aExitFlag) {
                                         &gSafeMode);
 
 #if defined(MOZ_HAS_REMOTE)
-  // Handle --no-remote and --new-instance command line arguments. Setup
-  // the environment to better accommodate other components and various
-  // restart scenarios.
+  // We disable remoting by default, unless -osint is used.
+  bool allowRemote = (CheckArg("allow-remote") == ARG_FOUND);
+  bool isOsint = (CheckArg("osint", nullptr, CheckArgFlag::None) == ARG_FOUND);
   ar = CheckArg("no-remote");
-  if (ar == ARG_FOUND || EnvHasValue("MOZ_NO_REMOTE")) {
+  if ((ar == ARG_FOUND) && allowRemote) {
+    PR_fprintf(PR_STDERR,
+               "Error: argument --no-remote is invalid when argument "
+               "--allow-remote is specified\n");
+    return 1;
+  }
+  if (!allowRemote && !isOsint) {
     mDisableRemoteClient = true;
     mDisableRemoteServer = true;
     gRestartWithoutRemote = true;
-    // We don't want to propagate MOZ_NO_REMOTE to potential child
-    // process.
-    SaveToEnv("MOZ_NO_REMOTE=");
+    SaveToEnv("MOZ_NO_REMOTE=1");
   }
 
   ar = CheckArg("new-instance");