diff --git a/mozilla/docshell/build/nsDocShellModule.cpp b/mozilla/docshell/build/nsDocShellModule.cpp
index 479a99e795e..38b590b7ecf 100644
--- a/mozilla/docshell/build/nsDocShellModule.cpp
+++ b/mozilla/docshell/build/nsDocShellModule.cpp
@@ -67,6 +67,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsURILoader)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsDocLoaderImpl, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsOSHelperAppService, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsExternalProtocolHandler)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsBlockedExternalProtocolHandler)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsPrefetchService, Init)
 
 #if defined(XP_MAC) || defined(XP_MACOSX)
@@ -112,6 +113,8 @@ static const nsModuleComponentInfo gDocShellModuleInfo[] = {
      nsOSHelperAppServiceConstructor, },
   { "Netscape Default Protocol Handler", NS_EXTERNALPROTOCOLHANDLER_CID, NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"default", 
      nsExternalProtocolHandlerConstructor, },
+  { "Netscape Default Blocked Protocol Handler", NS_BLOCKEDEXTERNALPROTOCOLHANDLER_CID, NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"default-blocked", 
+     nsBlockedExternalProtocolHandlerConstructor, },
   {  NS_PREFETCHSERVICE_CLASSNAME, NS_PREFETCHSERVICE_CID, NS_PREFETCHSERVICE_CONTRACTID,
      nsPrefetchServiceConstructor, },
 #if defined(XP_MAC) || defined(XP_MACOSX)
diff --git a/mozilla/netwerk/base/src/nsIOService.cpp b/mozilla/netwerk/base/src/nsIOService.cpp
index 650ae5c2c3d..58fcc7f0b8e 100644
--- a/mozilla/netwerk/base/src/nsIOService.cpp
+++ b/mozilla/netwerk/base/src/nsIOService.cpp
@@ -333,45 +333,51 @@ nsIOService::GetProtocolHandler(const char* scheme, nsIProtocolHandler* *result)
         ToLowerCase(contractID);
 
         rv = CallGetService(contractID.get(), result);
-
-        // If the pref for this protocol was explicitly set to false,
-        // stop here and do not invoke the default handler.
-        if (NS_FAILED(rv) && listedProtocol)
-            return NS_ERROR_UNKNOWN_PROTOCOL;
     }
     
     if (externalProtocol || NS_FAILED(rv)) {
+
+      // If the pref for this protocol was explicitly set to false, we want to
+      // use our special "blocked protocol" handler.  That will ensure we don't
+      // open any channels for this protocol.
+      if (listedProtocol) {
+        rv = CallGetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"default-blocked",
+                            result);
+        if (NS_FAILED(rv)) return NS_ERROR_UNKNOWN_PROTOCOL;
+      }
+      else {
+    
 #ifdef MOZ_X11
+        // check to see whether GnomeVFS can handle this URI scheme.  if it can
+        // create a nsIURI for the "scheme:", then we assume it has support for
+        // the requested protocol.  otherwise, we failover to using the default
+        // protocol handler.
 
-      // check to see if GnomeVFS can handle this URI scheme.  if it can create
-      // a nsIURI for the "scheme:", then we assume it has support for the
-      // requested protocol.  otherwise, we failover to using the default
-      // protocol handler.
+        // XXX should this be generalized into something that searches a
+        // category?  (see bug 234714)
 
-      // XXX should this be generalized into something that searches a category?
-      // (see bug 234714)
-
-      rv = CallGetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"moz-gnomevfs",
-                          result);
-      if (NS_SUCCEEDED(rv)) {
+        rv = CallGetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"moz-gnomevfs",
+                            result);
+        if (NS_SUCCEEDED(rv)) {
           nsCAutoString spec(scheme);
           spec.Append(':');
           nsCOMPtr<nsIURI> uri;
           rv = (*result)->NewURI(spec, nsnull, nsnull, getter_AddRefs(uri));
           if (NS_SUCCEEDED(rv))
-              return NS_OK;
+            return NS_OK;
           NS_RELEASE(*result);
-      }
-
+        }
 #endif
 
-      // okay we don't have a protocol handler to handle this url type, so use the default protocol handler.
-      // this will cause urls to get dispatched out to the OS ('cause we can't do anything with them) when 
-      // we try to read from a channel created by the default protocol handler.
+        // Okay we don't have a protocol handler to handle this url type, so use
+        // the default protocol handler.  This will cause urls to get dispatched
+        // out to the OS ('cause we can't do anything with them) when we try to
+        // read from a channel created by the default protocol handler.
 
-      rv = CallGetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"default",
-                          result);
-      if (NS_FAILED(rv)) return NS_ERROR_UNKNOWN_PROTOCOL;
+        rv = CallGetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX"default",
+                            result);
+        if (NS_FAILED(rv)) return NS_ERROR_UNKNOWN_PROTOCOL;
+      }
     }
 
     CacheProtocolHandler(scheme, *result);
diff --git a/mozilla/uriloader/exthandler/nsCExternalHandlerService.idl b/mozilla/uriloader/exthandler/nsCExternalHandlerService.idl
index a93c374c243..7b341991335 100644
--- a/mozilla/uriloader/exthandler/nsCExternalHandlerService.idl
+++ b/mozilla/uriloader/exthandler/nsCExternalHandlerService.idl
@@ -63,6 +63,9 @@ nsIExternalHelperAppService
 #define NS_EXTERNALPROTOCOLHANDLER_CID	\
 { 0xbd6390c8, 0xfbea, 0x11d4, {0x98, 0xf6, 0x0, 0x10, 0x83, 0x1, 0xe, 0x9b } }
 
+/* 9fa83ce7-d0ab-4ed3-938e-afafee435670 */
+#define NS_BLOCKEDEXTERNALPROTOCOLHANDLER_CID	\
+{ 0x9fa83ce7, 0xd0ab, 0x4ed3, {0x93, 0x8e, 0xaf, 0xaf, 0xee, 0x43, 0x56, 0x70 } }
 
 %}
 
diff --git a/mozilla/uriloader/exthandler/nsExternalProtocolHandler.cpp b/mozilla/uriloader/exthandler/nsExternalProtocolHandler.cpp
index e5c488d9a2a..0805e24812d 100644
--- a/mozilla/uriloader/exthandler/nsExternalProtocolHandler.cpp
+++ b/mozilla/uriloader/exthandler/nsExternalProtocolHandler.cpp
@@ -393,3 +393,16 @@ NS_IMETHODIMP nsExternalProtocolHandler::ExternalAppExistsForScheme(const nsACSt
   *_retval = PR_FALSE;
   return NS_OK;
 }
+
+nsBlockedExternalProtocolHandler::nsBlockedExternalProtocolHandler()
+{
+    m_schemeName = "default-blocked";
+}
+
+NS_IMETHODIMP
+nsBlockedExternalProtocolHandler::NewChannel(nsIURI *aURI,
+                                             nsIChannel **_retval)
+{
+    *_retval = nsnull;
+    return NS_ERROR_UNKNOWN_PROTOCOL;
+}
diff --git a/mozilla/uriloader/exthandler/nsExternalProtocolHandler.h b/mozilla/uriloader/exthandler/nsExternalProtocolHandler.h
index 466ec6a9dea..73001a79511 100644
--- a/mozilla/uriloader/exthandler/nsExternalProtocolHandler.h
+++ b/mozilla/uriloader/exthandler/nsExternalProtocolHandler.h
@@ -66,6 +66,12 @@ protected:
   nsCOMPtr<nsIExternalProtocolService> m_extProtService;
 };
 
+class nsBlockedExternalProtocolHandler: public nsExternalProtocolHandler
+{
+public:
+  nsBlockedExternalProtocolHandler();
+  NS_IMETHOD NewChannel(nsIURI *aURI, nsIChannel **_retval);
+};
 
 #endif // nsExternalProtocolHandler_h___