From 4942dabbaeb456f1a90eda57d6d9e55428dfc375 Mon Sep 17 00:00:00 2001
From: "mike.morgan%oregonstate.edu"
 <mike.morgan%oregonstate.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 12 May 2005 17:17:39 +0000
Subject: [PATCH] bug 293727     backing out temp changes to mitigate firefox
 vulnerability     reverting should be secure based on the top-level rewrites
 done to divert non-secure versions

git-svn-id: svn://10.0.0.236/branches/MOZILLA_UPDATE_1_0_BRANCH@173328 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/update/core/inc_global.php     | 8 +++-----
 mozilla/webtools/update/core/inc_header.php     | 7 -------
 mozilla/webtools/update/developers/approval.php | 2 +-
 mozilla/webtools/update/extensions/moreinfo.php | 8 ++++----
 mozilla/webtools/update/extensions/showlist.php | 3 ++-
 mozilla/webtools/update/themes/moreinfo.php     | 2 +-
 mozilla/webtools/update/themes/showlist.php     | 3 ++-
 7 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/mozilla/webtools/update/core/inc_global.php b/mozilla/webtools/update/core/inc_global.php
index 6e48e105cd5..517a9a4fcd4 100644
--- a/mozilla/webtools/update/core/inc_global.php
+++ b/mozilla/webtools/update/core/inc_global.php
@@ -165,16 +165,14 @@ function uriparams() {
 // function installtrigger() -- print installtrigger function for extension/theme installation on page.
 // Usage null uriparams(string functionname) 
 // -----------------------------
-    
-$rndNum = md5(rand(1, 1048576));
 
 function installtrigger($functionname) {
-    global $rndNum;
     if ($functionname=="extensions") {
     echo'
         <script type="text/javascript">
         <!--
-        function install'.$rndNum.'( aEvent, extName, iconURL)  {   
+
+        function install( aEvent, extName, iconURL)  {   
             var p = new XMLHttpRequest();
             p.open("GET", "'.WEB_PATH.'/core/install.php?uri="+aEvent.target.href, false);
             p.send(null);
@@ -198,7 +196,7 @@ function installtrigger($functionname) {
     echo'
         <script type="text/javascript">
         <!--
-            function installTheme'.$rndNum.'( aEvent, extName) {
+            function installTheme( aEvent, extName) {
                 var p = new XMLHttpRequest();
                 p.open("GET", "'.WEB_PATH.'/core/install.php?uri="+aEvent.target.href, false);
                 p.send(null);
diff --git a/mozilla/webtools/update/core/inc_header.php b/mozilla/webtools/update/core/inc_header.php
index 90d9572f953..05a51dbbebd 100644
--- a/mozilla/webtools/update/core/inc_header.php
+++ b/mozilla/webtools/update/core/inc_header.php
@@ -121,11 +121,4 @@ if (!empty($page_headers)) {
 <!-- closes #header-->
 
 <hr class="hide">
-<br>
-<table style="border: solid red 4px;"><tr>
-<td style="border: solid black 1px; font-size: 1.1em; font-weight: bold; padding: 10px 15px 10px 15px;">
-<p>To address security concerns, we have made a number of changes, including temporarily changing the URL for this site.  If prompted, please <b>DO NOT</b> add this new URL
-(do-not-add.mozilla.org) to your Allowed Sites or White List.</p>
-<p><a href="http://wiki.mozilla.org/Installing_Extensions">Instructions for Manually Installing Extensions and Themes</a></p>
-</td></tr></table>
 
diff --git a/mozilla/webtools/update/developers/approval.php b/mozilla/webtools/update/developers/approval.php
index 5918a330a40..b3fb797fb9e 100755
--- a/mozilla/webtools/update/developers/approval.php
+++ b/mozilla/webtools/update/developers/approval.php
@@ -175,7 +175,7 @@ WHERE `approved` = '?' GROUP BY TV.URI ORDER BY TV.DateUpdated ASC";
         echo " <span>(<a href=\"javascript:void(InstallTrigger.installChrome(InstallTrigger.SKIN,'".addslashes($row['URI'])."','".addslashes($row['Name']." ".$row['Version'])."'))\">Install Now</a>)</span>\n";
     } else {
         // Show extensions install link.
-        echo " <span>(<a href=\"javascript:alert('Temporarily Disabled');\">Install Now</a>)</span>";
+        echo " <span>(<a href=\"javascript:void(InstallTrigger.install({'".addslashes($row['Name'].$row['Version'])."':'".addslashes($row['URI'])."'}))\">Install Now</a>)</span>";
     }
 
     // Show a download now link.
diff --git a/mozilla/webtools/update/extensions/moreinfo.php b/mozilla/webtools/update/extensions/moreinfo.php
index 89a37f095ce..4904761c9b7 100644
--- a/mozilla/webtools/update/extensions/moreinfo.php
+++ b/mozilla/webtools/update/extensions/moreinfo.php
@@ -362,9 +362,9 @@ $sql = "SELECT TM.ID, TM.Name, TM.DateAdded, TM.DateUpdated, TM.Homepage, TM.Des
 
             if ($appname=="Thunderbird") { 
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
-              echo "<a href=\"$downloadURL\" title=\"Right-Click to Download $name $version\">";
+              echo "<a href=\"$downloadURL\" onclick=\"return install(event,'".addslashes($name)." $version for Thunderbird', '../images/default.png');\"  title=\"Right-Click to Download $name $version\">";
             } else {
-                echo"<b><a href=\"$uri\" TITLE=\"Install $name $version (Right-Click to Download)\">";
+                echo"<b><a href=\"$uri\" onclick=\"return install(event,'".addslashes($name)." $version', '../images/default.png');\" TITLE=\"Install $name $version (Right-Click to Download)\">";
             }
         ?>Install Now</a></b> (<?php echo"$filesize"; ?>&nbsp;KB&nbsp;File)</div></div>
 
@@ -551,9 +551,9 @@ $sql = "SELECT TM.ID, TM.Name, TM.DateAdded, TM.DateUpdated, TM.Homepage, TM.Des
             echo"<DIV class=\"iconbar\">";
             if ($appname=="Thunderbird") {
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
-              echo "<a href=\"$downloadURL\">";
+              echo "<a href=\"$downloadURL\" onclick=\"return install(event,'".addslashes($name)." $version for Thunderbird', '../images/default.png');\">";
             } else {
-                echo"<a href=\"$uri\">";
+                echo"<a href=\"$uri\" onclick=\"return install(event,'".addslashes($name)." $version', '../images/default.png');\">";
             }
             echo"<IMG SRC=\"../images/download.png\" HEIGHT=34 WIDTH=34 TITLE=\"Install $name (Right-Click to Download)\" ALT=\"\">Install</A><BR><SPAN class=\"filesize\">Size: $filesize kb</SPAN></DIV>";
             echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";
diff --git a/mozilla/webtools/update/extensions/showlist.php b/mozilla/webtools/update/extensions/showlist.php
index 6b978e54380..9b79b040372 100644
--- a/mozilla/webtools/update/extensions/showlist.php
+++ b/mozilla/webtools/update/extensions/showlist.php
@@ -443,7 +443,8 @@ echo"<DIV class=\"iconbar\">";
 if ($appname=="Thunderbird") {
     echo"<A HREF=\"moreinfo.php?".uriparams()."&amp;id=$id\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"More Info about $name\" ALT=\"\">More Info</A>";
 } else {
-    echo"<a href=\"$uri\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
+    echo"<a href=\"$uri\" onclick=\"return install(event,'".addslashes($name.' '.$version)."',
+    '../images/default.png');\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
 }
 echo"<BR><SPAN class=\"filesize\">&nbsp;&nbsp;$filesize kb</SPAN></DIV>";
 echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";
diff --git a/mozilla/webtools/update/themes/moreinfo.php b/mozilla/webtools/update/themes/moreinfo.php
index 8f98a23b4de..34a86fa0938 100644
--- a/mozilla/webtools/update/themes/moreinfo.php
+++ b/mozilla/webtools/update/themes/moreinfo.php
@@ -378,7 +378,7 @@ if (isset($_GET["vid"])) {
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
               echo"<a href=\"$downloadURL\" onclick=\"return installTheme(event,'".addslashes($name)." $version for Thunderbird');\"  title=\"Right-Click to Download $name $version\">";
             } else {
-                echo"<b><a href=\"$uri\" TITLE=\"Install $name $version (Right-Click to Download)\">";
+                echo"<b><a href=\"$uri\" onclick=\"return installTheme(event,'".addslashes($name)." $version');\" TITLE=\"Install $name $version (Right-Click to Download)\">";
             }
         ?>Install Now</a></b>&nbsp;(<?php echo"$filesize"; ?>&nbsp;KB&nbsp;File)</div></div>
 
diff --git a/mozilla/webtools/update/themes/showlist.php b/mozilla/webtools/update/themes/showlist.php
index 704b8493376..ffbd405a9d2 100644
--- a/mozilla/webtools/update/themes/showlist.php
+++ b/mozilla/webtools/update/themes/showlist.php
@@ -445,7 +445,8 @@ echo"<DIV class=\"iconbar\">";
 if ($appname=="Thunderbird") {
     echo"<A HREF=\"moreinfo.php?".uriparams()."&amp;id=$id\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"More Info about $name\" ALT=\"\">More Info</A>";
 } else {
-    echo"<a href=\"$uri\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
+    echo"<a href=\"$uri\" onclick=\"return install(event,'".addslashes($name.' '.$version)."',
+    '../images/default.png');\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
 }
 echo"<BR><SPAN class=\"filesize\">&nbsp;&nbsp;$filesize kb</SPAN></DIV>";
 echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";