Changeset 651

Timestamp:

01/23/08 16:36:12 (10 months ago)

Author:

atr..@atrus.org

Message:

We should still prevent detection even if GM is disabled (c.f. 'flat' extension vulnerability). Also, get rid of the useless decode (packages are decoded for us).

Files:

• trunk/src/components/greasemonkey.js (modified) (1 diff)

trunk/src/components/greasemonkey.js

@@ -163 +163 @@
-    var ret = Ci.nsIContentPolicy.ACCEPT;
-
+    // block content detection of greasemonkey by denying GM
+    // chrome content, unless loaded from chrome
+    if (org && org.scheme != "chrome" && cl.scheme == "chrome" &&
+        cl.host == "greasemonkey") {
+      return Ci.nsIContentPolicy.REJECT_SERVER;
+    }
+
-    // don't intercept anything when GM is not enabled
-    if (!GM_getEnabled()) {
-      return ret;
-    }
-
-    // block content detection of greasemonkey by denying GM
-    // chrome content, unless loaded from chrome
-    if (org && org.scheme != "chrome" && cl.scheme == "chrome" &&
-        decodeURI(cl.host) == "greasemonkey") {
-      return Ci.nsIContentPolicy.REJECT_SERVER;
-    }
-