diff --git a/mozilla/allmakefiles.sh b/mozilla/allmakefiles.sh
index 17573d56b1d..036f1eb7615 100755
--- a/mozilla/allmakefiles.sh
+++ b/mozilla/allmakefiles.sh
@@ -1477,6 +1477,9 @@ for extension in $MOZ_EXTENSIONS; do
             extensions/schema-validation/public/Makefile
             extensions/schema-validation/src/Makefile
             " ;;
+        permissions ) MAKEFILES_extensions="$MAKEFILES_extensions
+            extensions/permissions/Makefile
+            " ;;
     esac
 done
 
@@ -2079,6 +2082,7 @@ MAKEFILES_zlib="modules/zlib/standalone/Makefile"
         offline-startup) add_makefiles "$MAKEFILES_offline_startup" ;;
         oji) add_makefiles "$MAKEFILES_oji" ;;
         p3p) add_makefiles "$MAKEFILES_p3p" ;;
+        permissions) add_makefiles "$MAKEFILES_permissions" ;;
         plugin) add_makefiles "$MAKEFILES_plugin" ;;
         png) add_makefiles "$MAKEFILES_png" ;;
         pref) add_makefiles "$MAKEFILES_pref" ;;
diff --git a/mozilla/configure.in b/mozilla/configure.in
index c7155b899a4..2f45d84b485 100644
--- a/mozilla/configure.in
+++ b/mozilla/configure.in
@@ -3476,7 +3476,7 @@ suite)
   MOZ_COMPOSER=1
   MOZ_PROFILESHARING=1
   MOZ_APP_VERSION=$MOZILLA_VERSION
-  MOZ_EXTENSIONS_DEFAULT=" cookie wallet content-packs xml-rpc xmlextras help p3p pref transformiix venkman inspector irc universalchardet typeaheadfind webservices spellcheck gnomevfs negotiateauth sroaming"
+  MOZ_EXTENSIONS_DEFAULT=" cookie wallet content-packs xml-rpc xmlextras help p3p pref transformiix venkman inspector irc universalchardet typeaheadfind webservices spellcheck gnomevfs negotiateauth sroaming permissions"
   ;;
 
 browser)
@@ -4106,7 +4106,7 @@ dnl ========================================================
 dnl = Enable compilation of specific extension modules
 dnl ========================================================
 
-MOZ_EXTENSIONS_ALL=" cookie wallet content-packs xml-rpc xmlextras help p3p pref transformiix venkman inspector irc universalchardet typeaheadfind webservices spellcheck gnomevfs negotiateauth sroaming xmlterm datetime finger cview layout-debug tasks sql xforms" 
+MOZ_EXTENSIONS_ALL=" cookie wallet content-packs xml-rpc xmlextras help p3p pref transformiix venkman inspector irc universalchardet typeaheadfind webservices spellcheck gnomevfs negotiateauth sroaming xmlterm datetime finger cview layout-debug tasks sql xforms permissions"
 
 MOZ_ARG_ENABLE_STRING(extensions,
 [  --enable-extensions     Enable extensions],
diff --git a/mozilla/extensions/cookie/resources/content/pref-images.xul b/mozilla/extensions/cookie/resources/content/pref-images.xul
index 1fb7589b99b..150cc6fa5db 100644
--- a/mozilla/extensions/cookie/resources/content/pref-images.xul
+++ b/mozilla/extensions/cookie/resources/content/pref-images.xul
@@ -92,15 +92,15 @@
     <description>&imageDetails;</description>
 
     <radiogroup id="networkImageBehaviour"
-                prefstring="network.image.imageBehavior">
+                prefstring="permissions.default.image">
       <radio value="2" label="&disableImages.label;"
              accesskey="&disableImages.accesskey;"
              oncommand="setDisables();"/>
-      <radio value="1" label="&accOrgImagesRadio.label;"
+      <radio value="3" label="&accOrgImagesRadio.label;"
              accesskey="&accOrgImagesRadio.accesskey;"
              id="accOrgImages" observes="haveImageBlocking"
              oncommand="setDisables();"/>
-      <radio value="0" label="&accAllImagesRadio.label;"
+      <radio value="1" label="&accAllImagesRadio.label;"
              accesskey="&accAllImagesRadio.accesskey;"
              oncommand="setDisables();"/>
     </radiogroup>
diff --git a/mozilla/extensions/permissions/nsContentBlocker.cpp b/mozilla/extensions/permissions/nsContentBlocker.cpp
index 68b9ef21967..07ad3d75557 100644
--- a/mozilla/extensions/permissions/nsContentBlocker.cpp
+++ b/mozilla/extensions/permissions/nsContentBlocker.cpp
@@ -90,6 +90,29 @@ nsContentBlocker::Init()
   rv = prefService->GetBranch("permissions.default.", getter_AddRefs(prefBranch));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Migrate old image blocker pref
+  nsCOMPtr<nsIPrefBranch> oldPrefBranch;
+  oldPrefBranch = do_QueryInterface(prefService);
+  PRInt32 oldPref;
+  oldPrefBranch->GetIntPref("network.image.imageBehavior", &oldPref);
+  if (oldPref) {
+    PRInt32 newPref;
+    switch (oldPref) {
+      default:
+        newPref = BEHAVIOR_ACCEPT;
+        break;
+      case 1:
+        newPref = BEHAVIOR_NOFOREIGN;
+        break;
+      case 2:
+        newPref = BEHAVIOR_REJECT;
+        break;
+    }
+    prefBranch->SetIntPref("image", newPref);
+    oldPrefBranch->ClearUserPref("network.image.imageBehavior");
+  }
+
+
   // The branch is not a copy of the prefservice, but a new object, because
   // it is a non-default branch. Adding obeservers to it will only work if
   // we make sure that the object doesn't die. So, keep a reference to it.
@@ -152,11 +175,15 @@ nsContentBlocker::ShouldLoad(PRUint32          aContentType,
       !scheme.LowerCaseEqualsLiteral("https"))
     return NS_OK;
 
-  PRBool shouldLoad;
-  rv = TestPermission(aContentLocation, aRequestingLocation, aContentType, &shouldLoad);
+  PRBool shouldLoad, fromPrefs;
+  rv = TestPermission(aContentLocation, aRequestingLocation, aContentType,
+                      &shouldLoad, &fromPrefs);
   NS_ENSURE_SUCCESS(rv, rv);
   if (!shouldLoad)
-    *aDecision = nsIContentPolicy::REJECT_SERVER;
+    if (fromPrefs)
+      *aDecision = nsIContentPolicy::REJECT_TYPE;
+    else
+      *aDecision = nsIContentPolicy::REJECT_SERVER;
 
   return NS_OK;
 }
@@ -195,8 +222,10 @@ nsresult
 nsContentBlocker::TestPermission(nsIURI *aCurrentURI,
                                  nsIURI *aFirstURI,
                                  PRInt32 aContentType,
-                                 PRBool *aPermission)
+                                 PRBool *aPermission,
+                                 PRBool *aFromPrefs)
 {
+  *aFromPrefs = PR_FALSE;
   // This default will also get used if there is an unknown value in the
   // permission list, or if the permission manager returns unknown values.
   *aPermission = PR_TRUE;
@@ -212,14 +241,14 @@ nsContentBlocker::TestPermission(nsIURI *aCurrentURI,
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If there is nothing on the list, use the default.
+  if (!permission) {
+    permission = mBehaviorPref[aContentType - 1];
+    *aFromPrefs = PR_TRUE;
+  }
+
   // Use the fact that the nsIPermissionManager values map to 
   // the BEHAVIOR_* values above.
   switch (permission) {
-  case nsIPermissionManager::UNKNOWN_ACTION:
-    permission = mBehaviorPref[aContentType - 1];
-    break;
-
-  // if we found an entry, use it
   case BEHAVIOR_ACCEPT:
     *aPermission = PR_TRUE;
     break;
diff --git a/mozilla/extensions/permissions/nsContentBlocker.h b/mozilla/extensions/permissions/nsContentBlocker.h
index 71a3929d43d..98f49c9ae5b 100644
--- a/mozilla/extensions/permissions/nsContentBlocker.h
+++ b/mozilla/extensions/permissions/nsContentBlocker.h
@@ -70,7 +70,8 @@ private:
   nsresult TestPermission(nsIURI *aCurrentURI,
                           nsIURI *aFirstURI,
                           PRInt32 aContentType,
-                          PRBool *aPermission);
+                          PRBool *aPermission,
+                          PRBool *aFromPrefs);
 
   nsCOMPtr<nsIPermissionManager> mPermissionManager;
   nsCOMPtr<nsIPrefBranchInternal> mPrefBranchInternal;