.eslintignore

@@ -147,6 +147,9 @@ js/src/Y.js
 # Fuzzing code for testing only, targeting the JS shell
 js/src/fuzz-tests/
 
+# uses `#include`
+mobile/android/app/000-tor-browser-android.js
+
 # Uses `#filter substitution`
 mobile/android/app/mobile.js
 mobile/android/app/geckoview-prefs.js

.gitlab/issue_templates/UXBug.md

+<!--
+* Use this issue template for reporting a new UX bug.
+-->
+
+### Summary
+**Summarize the bug encountered concisely.**
+
+
+### Steps to reproduce:
+**How one can reproduce the issue - this is very important.**
+
+1. Step 1
+2. Step 2
+3. ...
+
+### What is the current bug behavior?
+**What actually happens.**
+
+
+### What is the expected behavior?
+**What you want to see instead**
+
+
+
+## Relevant logs and/or screenshots
+**Do you have screenshots? Attach them to this ticket please.**
+
+/label ~tor-ux ~needs-investigation ~bug
+/assign @nah

.gitlab/issue_templates/bug.md

+<!--
+* Use this issue template for reporting a new bug.
+-->
+
+### Summary
+**Summarize the bug encountered concisely.**
+
+
+### Steps to reproduce:
+**How one can reproduce the issue - this is very important.**
+
+1. Step 1
+2. Step 2
+3. ...
+
+### What is the current bug behavior?
+**What actually happens.**
+
+
+### What is the expected behavior?
+**What you want to see instead**
+
+
+
+### Environment
+**Which operating system are you using? For example: Debian GNU/Linux 10.1, Windows 10, Ubuntu Xenial, FreeBSD 12.2, etc.**
+**Which installation method did you use? Distribution package (apt, pkg, homebrew), from source tarball, from Git, etc.**
+
+### Relevant logs and/or screenshots
+
+
+/label ~bug

.gitlab/merge_request_templates/default.md

+## Merge Info
+
+<!-- Bookkeeping information for release management -->
+
+- ### Related Issues
+  - tor-browser#xxxxx
+  - tor-browser-build#xxxxx
+  - etc
+
+- ### Backport Timeline
+  - [ ] **Immediate** - patchsets for critical bug fixes or other major blocker (e.g. fixes for a 0-day exploit) OR patchsets with trivial changes which do not need testing (e.g. fixes for typos or fixes easily verified in a local developer build)
+  - [ ] **Next Minor Stable Release** - patchset that needs to be verified in nightly before backport
+  - [ ] **Eventually** - patchset that needs to be verified in alpha before backport
+  - [ ] **No Backport** - patchset for the next major stable
+
+- ### Upstream Merging
+  - [ ] Merge to `base-browser` - typically for `!fixups` to patches in the `base-browser` branch, though sometimes new patches as well
+    - **NOTE**: if your changeset includes patches to both `base-browser` and `tor-browser` please please make separate merge requests for each part
+
+- ### Issue Tracking
+  - [ ] Link resolved issues with appropriate [Release Prep issue](https://gitlab.torproject.org/groups/tpo/applications/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep&first_page_size=20) for changelog generation
+
+## Change Description
+
+<!-- Whatever context the reviewer needs to effectively review the patchset -->
\ No newline at end of file

browser/actors/RFPHelperChild.jsm

-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-var EXPORTED_SYMBOLS = ["RFPHelperChild"];
-
-const { XPCOMUtils } = ChromeUtils.import(
-  "resource://gre/modules/XPCOMUtils.jsm"
-);
-
-const kPrefLetterboxing = "privacy.resistFingerprinting.letterboxing";
-
-XPCOMUtils.defineLazyPreferenceGetter(
-  this,
-  "isLetterboxingEnabled",
-  kPrefLetterboxing,
-  false
-);
-
-class RFPHelperChild extends JSWindowActorChild {
-  handleEvent(event) {
-    if (isLetterboxingEnabled && event.type == "resize") {
-      this.sendAsyncMessage("Letterboxing:ContentSizeUpdated");
-    }
-  }
-}

browser/actors/RFPHelperParent.jsm

-1; /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-var EXPORTED_SYMBOLS = ["RFPHelperParent"];
-
-const { XPCOMUtils } = ChromeUtils.import(
-  "resource://gre/modules/XPCOMUtils.jsm"
-);
-
-const kPrefLetterboxing = "privacy.resistFingerprinting.letterboxing";
-
-XPCOMUtils.defineLazyPreferenceGetter(
-  this,
-  "isLetterboxingEnabled",
-  kPrefLetterboxing,
-  false
-);
-
-class RFPHelperParent extends JSWindowActorParent {
-  receiveMessage(aMessage) {
-    if (
-      isLetterboxingEnabled &&
-      aMessage.name == "Letterboxing:ContentSizeUpdated"
-    ) {
-      let browser = this.browsingContext.top.embedderElement;
-      let window = browser.ownerGlobal;
-      window.RFPHelper.contentSizeUpdated(window);
-    }
-  }
-}

browser/actors/moz.build

@@ -80,8 +80,6 @@ FINAL_TARGET_FILES.actors += [
     "PromptParent.jsm",
     "RefreshBlockerChild.jsm",
     "RefreshBlockerParent.jsm",
-    "RFPHelperChild.jsm",
-    "RFPHelperParent.jsm",
     "ScreenshotsComponentChild.jsm",
     "SearchSERPTelemetryChild.jsm",
     "SearchSERPTelemetryParent.jsm",

browser/app/macbuild/Contents/MacOS-files.in

@@ -17,7 +17,6 @@
 #if defined(MOZ_CRASHREPORTER)
 /minidump-analyzer
 #endif
-/pingsender
 /pk12util
 /ssltunnel
 /xpcshell

browser/app/permissions

@@ -6,22 +6,3 @@
 # * permission is an integer between 1 and 15
 # Permissions defined here will also be set for private browsing.
 # See PermissionManager.cpp for more...
-
-# UITour
-# Bug 1557153: www.mozilla.org gets a special workaround in UITourChild.jsm
-origin	uitour	1	https://www.mozilla.org
-origin	uitour	1	https://monitor.firefox.com
-origin	uitour	1	https://screenshots.firefox.com
-origin	uitour	1	https://support.mozilla.org
-origin	uitour	1	https://truecolors.firefox.com
-origin	uitour	1	about:home
-origin	uitour	1	about:newtab
-
-# XPInstall
-origin	install	1	https://addons.mozilla.org
-
-# Remote troubleshooting
-origin	remote-troubleshooting	1	https://support.mozilla.org
-
-# addon install
-origin	install	1	https://fpn.firefox.com

browser/app/profile/firefox.js

@@ -50,9 +50,9 @@ pref("extensions.recommendations.themeRecommendationUrl", "https://color.firefox
 
 pref("extensions.update.autoUpdateDefault", true);
 
-// Check AUS for system add-on updates.
-pref("extensions.systemAddon.update.url", "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
-pref("extensions.systemAddon.update.enabled", true);
+// No AUS check for system add-on updates for Tor Browser users.
+pref("extensions.systemAddon.update.url", "");
+pref("extensions.systemAddon.update.enabled", false);
 
 // Disable add-ons that are not installed by the user in all scopes by default.
 // See the SCOPE constants in AddonManager.jsm for values to use here.

browser/base/content/appmenu-viewcache.inc.xhtml

@@ -55,7 +55,12 @@
                      class="subviewbutton"
                      data-l10n-id="appmenuitem-new-private-window"
                      key="key_privatebrowsing"
-                     command="Tools:PrivateBrowsing"/>
+                     command="Tools:PrivateBrowsing"
+                     hidden="true"/>
+      <toolbarseparator/>
+      <toolbarbutton id="appMenu-new-identity"
+                     class="subviewbutton"
+                     key="new-identity-key"/>
       <toolbarseparator/>
       <toolbarbutton id="appMenu-bookmarks-button"
                      class="subviewbutton subviewbutton-nav"
@@ -175,7 +180,8 @@
       <toolbarbutton id="appMenu-restoreSession"
                      data-l10n-id="appmenu-restore-session"
                      class="subviewbutton"
-                     command="Browser:RestoreLastSession"/>
+                     command="Browser:RestoreLastSession"
+                     hidden="true"/>
       <toolbarseparator/>
       <toolbarbutton id="appMenuClearRecentHistory"
                      data-l10n-id="appmenu-clear-history"

browser/base/content/browser-menubar.inc

@@ -28,6 +28,10 @@
                 <menuitem id="menu_newPrivateWindow"
                           command="Tools:PrivateBrowsing"
                           key="key_privatebrowsing" data-l10n-id="menu-file-new-private-window"/>
+                <menuseparator/>
+                <menuitem id="menu_newIdentity"
+                          key="new-identity-key"/>
+                <menuseparator/>
                 <menuitem id="menu_openLocation"
                           hidden="true"
                           command="Browser:OpenLocation"
@@ -48,7 +52,8 @@
                 <menuitem id="menu_savePage"
                           key="key_savePage"
                           command="Browser:SavePage" data-l10n-id="menu-file-save-page"/>
-#ifndef XP_MACOSX
+# bug 41117 - don't allow sharing as there is a proxy bypass theoretical risk, so restore send link in that case
+#if !defined(XP_MACOSX) || defined(MOZ_PROXY_BYPASS_PROTECTION)
                 <menuitem id="menu_sendLink"
                           command="Browser:SendLink" data-l10n-id="menu-file-email-link"/>
 #endif
@@ -453,6 +458,7 @@
      have their strings defined by appmenu-data-l10n-id. -->
                 <menuitem id="menu_openHelp"
                           oncommand="openHelpLink('firefox-help')"
+                          hidden="true"
                           data-l10n-id="menu-get-help"
                           appmenu-data-l10n-id="appmenu-get-help"
 #ifdef XP_MACOSX
@@ -462,14 +468,17 @@
 #endif
                 <menuitem id="feedbackPage"
                           oncommand="openFeedbackPage()"
+                          hidden="true"
                           data-l10n-id="menu-help-share-ideas"
                           appmenu-data-l10n-id="appmenu-help-share-ideas"/>
                 <menuitem id="helpSafeMode"
                           oncommand="safeModeRestart();"
+                          hidden="true"
                           data-l10n-id="menu-help-enter-troubleshoot-mode2"
                           appmenu-data-l10n-id="appmenu-help-enter-troubleshoot-mode2"/>
                 <menuitem id="troubleShooting"
                           oncommand="openTroubleshootingPage()"
+                          hidden="true"
                           data-l10n-id="menu-help-more-troubleshooting-info"
                           appmenu-data-l10n-id="appmenu-help-more-troubleshooting-info"/>
                 <menuitem id="help_reportSiteIssue"

browser/base/content/browser-safebrowsing.js

@@ -7,6 +7,13 @@
 
 var gSafeBrowsing = {
   setReportPhishingMenu() {
+    // tor-browser#18905: hide these menu entries
+    if (
+      !Services.prefs.getBoolPref("browser.safebrowsing.phishing.enabled", true)
+    ) {
+      return;
+    }
+
     // In order to detect whether or not we're at the phishing warning
     // page, we have to check the documentURI instead of the currentURI.
     // This is because when the DocShell loads an error page, the

browser/base/content/browser-sets.inc

@@ -388,4 +388,5 @@
          modifiers="accel,alt"
          internal="true"/>
 #endif
+    <key id="new-identity-key" modifiers="accel shift" key="U" oncommand="NewIdentityButton.onCommand(event)"/>
   </keyset>

browser/base/content/browser-siteIdentity.js

@@ -898,10 +898,10 @@ var gIdentityHandler = {
       gPermissionPanel.refreshPermissionIcons();
     }
 
-    // Hide the shield icon if it is a chrome page.
+    // Bug 26345: Hide tracking protection UI.
     gProtectionsHandler._trackingProtectionIconContainer.classList.toggle(
       "chromeUI",
-      this._isSecureInternalUI
+      true
     );
   },
 

browser/base/content/browser.css

@@ -98,6 +98,29 @@ body {
   -moz-window-dragging: drag;
 }
 
+/**
+  Never modify the following selector without synchronizing
+  LETTERBOX_CSS_SELECTOR in RFPHelper.jsm!
+**/
+.letterboxing .browserStack:not(.exclude-letterboxing) > browser {
+  /* width & height to be dynamically set by RFPHelper.jsm */
+  outline: 1px solid var(--chrome-content-separator-color);
+}
+
+.exclude-letterboxing > browser {
+  outline: initial;
+}
+
+:root:not([inDOMFullscreen]) .letterboxing.letterboxing-ready .browserStack:not(.exclude-letterboxing) {
+  place-content: start center;
+}
+
+/* extend down the toolbar's colors when letterboxing is enabled */
+.letterboxing {
+  background-color: var(--toolbar-bgcolor);
+  background-image: var(--toolbar-bgimage);
+}
+
 #toolbar-menubar[autohide="true"] {
   overflow: hidden;
 }

browser/base/content/browser.js

@@ -223,6 +223,16 @@ XPCOMUtils.defineLazyScriptGetter(
   ["DownloadsButton", "DownloadsIndicatorView"],
   "chrome://browser/content/downloads/indicator.js"
 );
+XPCOMUtils.defineLazyScriptGetter(
+  this,
+  ["SecurityLevelButton"],
+  "chrome://browser/content/securitylevel/securityLevel.js"
+);
+XPCOMUtils.defineLazyScriptGetter(
+  this,
+  ["NewIdentityButton"],
+  "chrome://browser/content/newidentity.js"
+);
 XPCOMUtils.defineLazyScriptGetter(
   this,
   "gEditItemOverlay",
@@ -1772,6 +1782,12 @@ var gBrowserInit = {
     // doesn't flicker as the window is being shown.
     DownloadsButton.init();
 
+    // Init the SecuritySettingsButton
+    SecurityLevelButton.init();
+
+    // Init the NewIdentityButton
+    NewIdentityButton.init();
+
     // Certain kinds of automigration rely on this notification to complete
     // their tasks BEFORE the browser window is shown. SessionStore uses it to
     // restore tabs into windows AFTER important parts like gMultiProcessBrowser
@@ -2492,6 +2508,10 @@ var gBrowserInit = {
 
     DownloadsButton.uninit();
 
+    SecurityLevelButton.uninit();
+
+    NewIdentityButton.uninit();
+
     gAccessibilityServiceIndicator.uninit();
 
     if (gToolbarKeyNavEnabled) {
@@ -4807,6 +4827,10 @@ let gShareUtils = {
    * Updates a sharing item in a given menu, creating it if necessary.
    */
   updateShareURLMenuItem(browser, insertAfterEl) {
+    if (!Services.prefs.getBoolPref("browser.share_menu.allow", false)) {
+      return false;
+    }
+
     // We only support "share URL" on macOS and on Windows 10:
     if (
       AppConstants.platform != "macosx" &&
@@ -5980,6 +6004,7 @@ var TabsProgressListener = {
   onStateChange(aBrowser, aWebProgress, aRequest, aStateFlags, aStatus) {
     // Collect telemetry data about tab load times.
     if (
+      AppConstants.MOZ_TELEMETRY_REPORTING &&
       aWebProgress.isTopLevel &&
       (!aRequest.originalURI || aRequest.originalURI.scheme != "about")
     ) {

browser/base/content/browser.xhtml

@@ -20,6 +20,8 @@
 <?xml-stylesheet href="chrome://browser/content/browser.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/content/tabbrowser.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/content/downloads/downloads.css" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/content/securitylevel/securityLevelPanel.css"?>
+<?xml-stylesheet href="chrome://browser/content/securitylevel/securityLevelButton.css"?>
 <?xml-stylesheet href="chrome://browser/content/places/places.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/content/usercontext/usercontext.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
@@ -85,6 +87,7 @@
 #ifdef NIGHTLY_BUILD
   <link rel="localization" href="preview/firefoxView.ftl"/>
 #endif
+  <link rel="localization" href="browser/languageNotification.ftl"/>
 
   <title data-l10n-id="browser-main-window-title"></title>
 
@@ -112,6 +115,7 @@
   Services.scriptloader.loadSubScript("chrome://browser/content/places/places-menupopup.js", this);
   Services.scriptloader.loadSubScript("chrome://browser/content/search/autocomplete-popup.js", this);
   Services.scriptloader.loadSubScript("chrome://browser/content/search/searchbar.js", this);
+  Services.scriptloader.loadSubScript("chrome://browser/content/languageNotification.js", this);
 
   window.onload = gBrowserInit.onLoad.bind(gBrowserInit);
   window.onunload = gBrowserInit.onUnload.bind(gBrowserInit);

browser/base/content/languageNotification.js

+"use strict";
+
+// Show a prompt to suggest to the user that they can change the UI language.
+// Show it only the first time, and then do not show it anymore
+window.addEventListener("load", async () => {
+  const PREF_NAME = "intl.language_notification.shown";
+
+  if (Services.prefs.getBoolPref(PREF_NAME, false)) {
+    return;
+  }
+
+  // Already customized, we do not suggest to change it again...
+  if (Services.prefs.getCharPref("intl.locale.requested", "") !== "") {
+    // ... and we never show the notification, either
+    Services.prefs.setBoolPref(PREF_NAME, true);
+    return;
+  }
+
+  // In sync with our changes on browser/components/preferences/main.js for
+  // tor-browser#41369 and tor-browser#41372.
+  const code =
+    Services.locale.appLocaleAsBCP47 === "ja-JP-macos"
+      ? "ja"
+      : Services.locale.appLocaleAsBCP47;
+  const language = Services.intl
+    .getLocaleDisplayNames(undefined, [code], { preferNative: true })[0]
+    .replace(/\s*\(.+\)$/g, "");
+
+  // We want to determine whether the current locale was chosen based on the
+  // system locales, in which case langauge negotiation returns a match, or
+  // whether it simply defaulted to en-US.
+  const matchingSystem = !!Services.locale.negotiateLanguages(
+    // Since intl.locale.requested is empty, we expect requestedLocales to match
+    // the user's system locales.
+    Services.locale.requestedLocales,
+    Services.locale.availableLocales
+  ).length;
+  const label = await document.l10n.formatValue(
+    matchingSystem
+      ? "language-notification-label-system"
+      : "language-notification-label",
+    { language }
+  );
+
+  const buttons = [
+    {
+      "l10n-id": "language-notification-button",
+      callback() {
+        openPreferences("general-language");
+      },
+    },
+  ];
+
+  gNotificationBox.appendNotification(
+    "language-notification",
+    {
+      label,
+      priority: gNotificationBox.PRIORITY_INFO_HIGH,
+    },
+    buttons
+  );
+
+  // We do not wait for the user to either click on the button or dismiss the
+  // notification: after we have shown it once, we take for granted that the
+  // user has seen it and we never show it again.
+  Services.prefs.setBoolPref(PREF_NAME, true);
+});