Re: [resend] freeze break: confirmation dialog for extension installation

[Gabor Kelemen <kelemeng gnome hu>]

2011-09-11 23:43 keltezéssel, Owen Taylor írta:
> [ sent to gnome-18n last time, resend with the correct address ]
>
> As part of the work for extensions.gnome.org we've added a way to have
> the extensions.gnome.org website trigger downloading and installing
> an extension via a browser plugin. (The browser plugin and the download
> are locked to extension.gnome.org.)
>
> One thing that I pointed out in review was that I thought it was
> important to have an obviously client-side dialog before downloading and
> installing an extension - to make it clear to the user what is going on,
> and catch any funny business is going on.
>
> (E.g., XSS exploit on shell.gnome.org allows someone to script the
> plugin to download an extension they've snuck past code review.)
>
> https://mail.gnome.org/archives/desktop-devel-list/2011-August/msg00242.html
>
> Adding this dialog requires a string freeze break to add the strings:
>
>    Download and install '%s' from extensions.gnome.org?
>    Install
>
> (First string still under discussion, but will be something like that.)
>
> Current patch on: https://bugzilla.gnome.org/show_bug.cgi?id=658612
Sounds serious enough. i18n approval 1/2.

Regards
Gabor Kelemen