From 9a048281b182b69e933af4e9a7af4e88518a7dfe Mon Sep 17 00:00:00 2001
From: "cst%andrew.cmu.edu"
 <cst%andrew.cmu.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 8 May 2005 20:58:44 +0000
Subject: [PATCH] Don't call install() function, link directly to XPIs, add
 security notice r=cbeard

git-svn-id: svn://10.0.0.236/branches/MOZILLA_UPDATE_1_0_BRANCH@173194 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/update/core/inc_header.php     | 7 +++++++
 mozilla/webtools/update/developers/approval.php | 2 +-
 mozilla/webtools/update/extensions/moreinfo.php | 8 ++++----
 mozilla/webtools/update/extensions/showlist.php | 3 +--
 mozilla/webtools/update/themes/moreinfo.php     | 2 +-
 mozilla/webtools/update/themes/showlist.php     | 3 +--
 6 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/mozilla/webtools/update/core/inc_header.php b/mozilla/webtools/update/core/inc_header.php
index 05a51dbbebd..90d9572f953 100644
--- a/mozilla/webtools/update/core/inc_header.php
+++ b/mozilla/webtools/update/core/inc_header.php
@@ -121,4 +121,11 @@ if (!empty($page_headers)) {
 <!-- closes #header-->
 
 <hr class="hide">
+<br>
+<table style="border: solid red 4px;"><tr>
+<td style="border: solid black 1px; font-size: 1.1em; font-weight: bold; padding: 10px 15px 10px 15px;">
+<p>To address security concerns, we have made a number of changes, including temporarily changing the URL for this site.  If prompted, please <b>DO NOT</b> add this new URL
+(do-not-add.mozilla.org) to your Allowed Sites or White List.</p>
+<p><a href="http://wiki.mozilla.org/Installing_Extensions">Instructions for Manually Installing Extensions and Themes</a></p>
+</td></tr></table>
 
diff --git a/mozilla/webtools/update/developers/approval.php b/mozilla/webtools/update/developers/approval.php
index 43f53bbe914..5918a330a40 100755
--- a/mozilla/webtools/update/developers/approval.php
+++ b/mozilla/webtools/update/developers/approval.php
@@ -175,7 +175,7 @@ WHERE `approved` = '?' GROUP BY TV.URI ORDER BY TV.DateUpdated ASC";
         echo " <span>(<a href=\"javascript:void(InstallTrigger.installChrome(InstallTrigger.SKIN,'".addslashes($row['URI'])."','".addslashes($row['Name']." ".$row['Version'])."'))\">Install Now</a>)</span>\n";
     } else {
         // Show extensions install link.
-        echo " <span>(<a href=\"javascript:void(InstallTrigger.install$rndNum){'".addslashes($row['Name'].$row['Version'])."':'".addslashes($row['URI'])."'}))\">Install Now</a>)</span>";
+        echo " <span>(<a href=\"javascript:alert('Temporarily Disabled');\">Install Now</a>)</span>";
     }
 
     // Show a download now link.
diff --git a/mozilla/webtools/update/extensions/moreinfo.php b/mozilla/webtools/update/extensions/moreinfo.php
index 651d69f5d23..89a37f095ce 100644
--- a/mozilla/webtools/update/extensions/moreinfo.php
+++ b/mozilla/webtools/update/extensions/moreinfo.php
@@ -362,9 +362,9 @@ $sql = "SELECT TM.ID, TM.Name, TM.DateAdded, TM.DateUpdated, TM.Homepage, TM.Des
 
             if ($appname=="Thunderbird") { 
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
-              echo "<a href=\"$downloadURL\" onclick=\"return install$rndNum(event,'".addslashes($name)." $version for Thunderbird', '../images/default.png');\"  title=\"Right-Click to Download $name $version\">";
+              echo "<a href=\"$downloadURL\" title=\"Right-Click to Download $name $version\">";
             } else {
-                echo"<b><a href=\"$uri\" onclick=\"return install$rndNum(event,'".addslashes($name)." $version', '../images/default.png');\" TITLE=\"Install $name $version (Right-Click to Download)\">";
+                echo"<b><a href=\"$uri\" TITLE=\"Install $name $version (Right-Click to Download)\">";
             }
         ?>Install Now</a></b> (<?php echo"$filesize"; ?>&nbsp;KB&nbsp;File)</div></div>
 
@@ -551,9 +551,9 @@ $sql = "SELECT TM.ID, TM.Name, TM.DateAdded, TM.DateUpdated, TM.Homepage, TM.Des
             echo"<DIV class=\"iconbar\">";
             if ($appname=="Thunderbird") {
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
-              echo "<a href=\"$downloadURL\" onclick=\"return install$rndNum(event,'".addslashes($name)." $version for Thunderbird', '../images/default.png');\">";
+              echo "<a href=\"$downloadURL\">";
             } else {
-                echo"<a href=\"$uri\" onclick=\"return install$rndNum(event,'".addslashes($name)." $version', '../images/default.png');\">";
+                echo"<a href=\"$uri\">";
             }
             echo"<IMG SRC=\"../images/download.png\" HEIGHT=34 WIDTH=34 TITLE=\"Install $name (Right-Click to Download)\" ALT=\"\">Install</A><BR><SPAN class=\"filesize\">Size: $filesize kb</SPAN></DIV>";
             echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";
diff --git a/mozilla/webtools/update/extensions/showlist.php b/mozilla/webtools/update/extensions/showlist.php
index e60703fe7d3..6b978e54380 100644
--- a/mozilla/webtools/update/extensions/showlist.php
+++ b/mozilla/webtools/update/extensions/showlist.php
@@ -443,8 +443,7 @@ echo"<DIV class=\"iconbar\">";
 if ($appname=="Thunderbird") {
     echo"<A HREF=\"moreinfo.php?".uriparams()."&amp;id=$id\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"More Info about $name\" ALT=\"\">More Info</A>";
 } else {
-    echo"<a href=\"$uri\" onclick=\"return install$rndNum(event,'".addslashes($name.' '.$version)."',
-    '../images/default.png');\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
+    echo"<a href=\"$uri\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
 }
 echo"<BR><SPAN class=\"filesize\">&nbsp;&nbsp;$filesize kb</SPAN></DIV>";
 echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";
diff --git a/mozilla/webtools/update/themes/moreinfo.php b/mozilla/webtools/update/themes/moreinfo.php
index 34a86fa0938..8f98a23b4de 100644
--- a/mozilla/webtools/update/themes/moreinfo.php
+++ b/mozilla/webtools/update/themes/moreinfo.php
@@ -378,7 +378,7 @@ if (isset($_GET["vid"])) {
               $downloadURL=mozupd_buildDownloadURL($uri,$name,$version);
               echo"<a href=\"$downloadURL\" onclick=\"return installTheme(event,'".addslashes($name)." $version for Thunderbird');\"  title=\"Right-Click to Download $name $version\">";
             } else {
-                echo"<b><a href=\"$uri\" onclick=\"return installTheme(event,'".addslashes($name)." $version');\" TITLE=\"Install $name $version (Right-Click to Download)\">";
+                echo"<b><a href=\"$uri\" TITLE=\"Install $name $version (Right-Click to Download)\">";
             }
         ?>Install Now</a></b>&nbsp;(<?php echo"$filesize"; ?>&nbsp;KB&nbsp;File)</div></div>
 
diff --git a/mozilla/webtools/update/themes/showlist.php b/mozilla/webtools/update/themes/showlist.php
index 03f5ae4b1c3..704b8493376 100644
--- a/mozilla/webtools/update/themes/showlist.php
+++ b/mozilla/webtools/update/themes/showlist.php
@@ -445,8 +445,7 @@ echo"<DIV class=\"iconbar\">";
 if ($appname=="Thunderbird") {
     echo"<A HREF=\"moreinfo.php?".uriparams()."&amp;id=$id\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"More Info about $name\" ALT=\"\">More Info</A>";
 } else {
-    echo"<a href=\"$uri\" onclick=\"return installTheme$rndNum(event,'".addslashes($name.' '.$version)."',
-    '../images/default.png');\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
+    echo"<a href=\"$uri\"><IMG SRC=\"../images/download.png\" HEIGHT=32 WIDTH=32 TITLE=\"Install $name\" ALT=\"\">Install</A>";
 }
 echo"<BR><SPAN class=\"filesize\">&nbsp;&nbsp;$filesize kb</SPAN></DIV>";
 echo"<DIV class=\"iconbar\"><IMG SRC=\"../images/".strtolower($appname)."_icon.png\" HEIGHT=34 WIDTH=34 ALT=\"\">&nbsp;For $appname:<BR>&nbsp;&nbsp;$minappver - $maxappver</DIV>";