From ab3519a6372e879e726d08a119b608a404982ad5 Mon Sep 17 00:00:00 2001
From: "bugzilla%arlen.demon.co.uk"
 <bugzilla%arlen.demon.co.uk@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 8 Aug 2005 18:29:12 +0000
Subject: [PATCH] Bug 296758 Adding phishing detection to mailnews p=me
 r=mnyromyr sr=bienvenu a=asa

git-svn-id: svn://10.0.0.236/trunk@177340 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../content/mail3PaneWindowCommands.js        |  14 +-
 .../content/mail3PaneWindowVertLayout.xul     |   5 +-
 .../base/resources/content/mailWindow.js      |  67 ++---
 .../resources/content/mailWindowOverlay.js    | 192 +++++++++++---
 .../resources/content/mailWindowOverlay.xul   |  61 ++++-
 .../base/resources/content/messageWindow.js   |  12 +
 .../base/resources/content/messageWindow.xul  |   5 +-
 .../base/resources/content/messenger.xul      |   5 +-
 .../resources/content/msgHdrViewOverlay.js    |   3 +
 .../resources/content/msgMail3PaneWindow.js   |   5 +-
 .../resources/content/phishingDetector.js     | 239 ++++++++++++++++++
 .../base/resources/locale/en-US/messenger.dtd |  17 +-
 .../locale/en-US/messenger.properties         |   6 +
 mozilla/mailnews/jar.mn                       |   1 +
 mozilla/mailnews/mailnews.js                  |   1 +
 mozilla/themes/classic/jar.mn                 |   1 +
 .../messenger/icons/remote-blocked.png        | Bin 0 -> 2205 bytes
 .../classic/messenger/primaryToolbar.css      |  23 +-
 mozilla/themes/modern/jar.mn                  |   1 +
 .../modern/messenger/icons/remote-blocked.png | Bin 0 -> 2170 bytes
 .../modern/messenger/primaryToolbar.css       |  24 +-
 .../resources/content/contentAreaClick.js     |  26 +-
 22 files changed, 599 insertions(+), 109 deletions(-)
 create mode 100755 mozilla/mailnews/base/resources/content/phishingDetector.js
 create mode 100755 mozilla/themes/classic/messenger/icons/remote-blocked.png
 create mode 100755 mozilla/themes/modern/messenger/icons/remote-blocked.png

diff --git a/mozilla/mailnews/base/resources/content/mail3PaneWindowCommands.js b/mozilla/mailnews/base/resources/content/mail3PaneWindowCommands.js
index f9b51172b67..4b7202e8140 100644
--- a/mozilla/mailnews/base/resources/content/mail3PaneWindowCommands.js
+++ b/mozilla/mailnews/base/resources/content/mail3PaneWindowCommands.js
@@ -210,6 +210,8 @@ var DefaultController =
 			case "cmd_markAsJunk":
 			case "cmd_markAsNotJunk":
       case "cmd_recalculateJunkScore":
+      case "cmd_markAsShowRemote":
+      case "cmd_markAsNotPhish":
       case "cmd_applyFilters":
       case "cmd_runJunkControls":
       case "cmd_deleteJunk":
@@ -322,12 +324,16 @@ var DefaultController =
       case "cmd_markAsFlagged":
       case "button_file":
       case "cmd_file":
-        return (GetNumSelectedMessages() > 0 );
+        return (GetNumSelectedMessages() > 0);
       case "cmd_markAsJunk":
       case "cmd_markAsNotJunk":
       case "cmd_recalculateJunkScore":
         // can't do news on junk yet.
         return (GetNumSelectedMessages() > 0 && !isNewsURI(GetFirstSelectedMessage()));
+      case "cmd_markAsShowRemote":
+        return (GetNumSelectedMessages() > 0 && checkMsgHdrPropertyIsNot("remoteContentPolicy", kAllowRemoteContent));
+      case "cmd_markAsNotPhish":
+        return (GetNumSelectedMessages() > 0 && checkMsgHdrPropertyIsNot("notAPhishMessage", kNotAPhishMessage));
       case "cmd_applyFilters":
         if (gDBView)
           gDBView.getCommandStatus(nsMsgViewCommandType.applyFilters, enabled, checkStatus);
@@ -633,6 +639,12 @@ var DefaultController =
       case "cmd_recalculateJunkScore":
         analyzeMessagesForJunk();
         return;
+      case "cmd_markAsShowRemote":
+        LoadMsgWithRemoteContent();
+        return;
+      case "cmd_markAsNotPhish":
+        MsgIsNotAScam();
+        return;
       case "cmd_applyFilters":
         MsgApplyFilters(null);
         return;
diff --git a/mozilla/mailnews/base/resources/content/mail3PaneWindowVertLayout.xul b/mozilla/mailnews/base/resources/content/mail3PaneWindowVertLayout.xul
index b694dee2270..ccd3adaa07a 100644
--- a/mozilla/mailnews/base/resources/content/mail3PaneWindowVertLayout.xul
+++ b/mozilla/mailnews/base/resources/content/mail3PaneWindowVertLayout.xul
@@ -84,6 +84,7 @@
 <script type="application/x-javascript" src="chrome://messenger/content/messengerdnd.js"/>
 <script type="application/x-javascript" src="chrome://messenger/content/accountUtils.js"/>
 <script type="application/x-javascript" src="chrome://messenger/content/mail-offline.js"/>
+<script type="application/x-javascript" src="chrome://messenger/content/phishingDetector.js"/>
 <script type="application/x-javascript" src="chrome://communicator/content/contentAreaClick.js"/>
 <script type="application/x-javascript" src="chrome://global/content/nsTransferable.js"/>
 <script type="application/x-javascript" src="chrome://global/content/nsDragAndDrop.js"/>
@@ -184,14 +185,14 @@
     </splitter>
 
     <vbox id="messagepanebox" flex="2" minheight="100" height="200" minwidth="100" width="200" persist="collapsed height width" class="window-focusborder" focusring="false">
-      <hbox id="junkBar"/>
+      <deck id="msgNotificationBar"/>
 
       <hbox id="msgHeaderView"/>
 
       <browser id="messagepane" name="messagepane" height="0" flex="1"
                context="messagePaneContext" minwidth="1" minheight="1"
                disablesecurity="true" disablehistory="true" autofind="false"
-               type="content-primary" onclick="messagePaneOnClick(event);"/>
+               type="content-primary" onclick="return messagePaneOnClick(event);"/>
     </vbox>
   </box>
 
diff --git a/mozilla/mailnews/base/resources/content/mailWindow.js b/mozilla/mailnews/base/resources/content/mailWindow.js
index c60e11f4a19..0282beefa54 100644
--- a/mozilla/mailnews/base/resources/content/mailWindow.js
+++ b/mozilla/mailnews/base/resources/content/mailWindow.js
@@ -228,16 +228,15 @@ function messagePaneOnClick(event)
   // if this is stand alone mail (no browser)
   // or this isn't a simple left click, do nothing, and let the normal code execute
   if (event.button != 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey)
-  {
-    contentAreaClick(event);
-    return;
-  }
+    return contentAreaClick(event);
 
   // try to determine the href for what you are clicking on.  
   // for example, it might be "" if you aren't left clicking on a link
-  var href = hrefForClickEvent(event);
-  if (!href) 
-    return;
+  var ceParams = {event: event, href: "", linkNode: null};
+  hrefAndLinkNodeForClickEvent(ceParams);
+  var href = ceParams.href;
+  if (!href)
+    return true;
 
   // we know that http://, https://, ftp://, file://, chrome://, 
   // resource://, about:, and gopher:// (as if), 
@@ -248,7 +247,7 @@ function messagePaneOnClick(event)
   // and let the normal code handle it
   var needABrowser = /(^http(s)?:|^ftp:|^file:|^gopher:|^chrome:|^resource:|^about:)/i;
   if (href.search(needABrowser) == -1) 
-    return;
+    return true;
 
   // however, if the protocol should not be loaded internally, then we should
   // not put up a new browser window.  we should just let the usual processing
@@ -258,7 +257,7 @@ function messagePaneOnClick(event)
     extProtService = extProtService.QueryInterface(Components.interfaces.nsIExternalProtocolService);
     var scheme = href.substring(0, href.indexOf(":"));
     if (!extProtService.isExposedProtocol(scheme))
-      return;
+      return true;
   } 
   catch (ex) {} // ignore errors, and just assume that we can proceed.
 
@@ -270,7 +269,11 @@ function messagePaneOnClick(event)
   // we want to preventDefault, so that in
   // nsGenericHTMLElement::HandleDOMEventForAnchors(), we don't try to handle the click again
   event.preventDefault();
+  if (isPhishingURL(ceParams.linkNode, false))
+    return false;
+
   openTopBrowserWith(href);
+  return true;
 }
 
 function AddDataSources()
@@ -529,30 +532,32 @@ function StopUrls()
   msgWindow.StopUrls();
 }
 
-function loadStartPage() {
-    try {
-        // collapse the junk bar
-        SetUpJunkBar(null);
+function loadStartPage()
+{
+  try
+  {
+    gMessageNotificationBar.clearMsgNotifications();
 
-        var startpageenabled = pref.getBoolPref("mailnews.start_page.enabled");
-
-        if (startpageenabled) {
-            var startpage = pref.getComplexValue("mailnews.start_page.url",
-                                                 Components.interfaces.nsIPrefLocalizedString).data;
-            if (startpage != "") {
-                // first, clear out the charset setting.
-                messenger.setDisplayCharset("");
-
-                GetMessagePaneFrame().location.href = startpage;
-                //dump("start message pane with: " + startpage + "\n");
-                ClearMessageSelection();
-            }
-        }
-    }
-    catch (ex) {
-        dump("Error loading start page.\n");
-        return;
+    var startpageenabled = pref.getBoolPref("mailnews.start_page.enabled");
+    if (startpageenabled)
+    {
+      var startpage = pref.getComplexValue("mailnews.start_page.url",
+                                           Components.interfaces.nsIPrefLocalizedString).data;
+      if (startpage)
+      {
+        // first, clear out the charset setting.
+        messenger.setDisplayCharset("");
+        GetMessagePaneFrame().location.href = startpage;
+        //dump("start message pane with: " + startpage + "\n");
+        ClearMessageSelection();
+      }
     }
+  }
+  catch (ex)
+  {
+    dump("Error loading start page.\n");
+    return;
+  }
 }
 
 // Display AccountCentral page when users clicks on the Account Folder.
diff --git a/mozilla/mailnews/base/resources/content/mailWindowOverlay.js b/mozilla/mailnews/base/resources/content/mailWindowOverlay.js
index 8d71a8e62aa..9293ad2b242 100644
--- a/mozilla/mailnews/base/resources/content/mailWindowOverlay.js
+++ b/mozilla/mailnews/base/resources/content/mailWindowOverlay.js
@@ -27,6 +27,7 @@
  *   Jan Varga <varga@ku.sk>
  *   Seth Spitzer <sspitzer@netscape.com>
  *   David Bienvenu <bienvenu@netscape.com>
+ *   Ian Neal <bugzilla@arlen.demon.co.uk>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -53,6 +54,22 @@ const kClassicMailLayout = 0;
 const kWideMailLayout = 1;
 const kVerticalMailLayout = 2;
 
+// Per message header flags to keep track of whether the user is allowing remote
+// content for a particular message. 
+// if you change or add more values to these constants, be sure to modify
+// the corresponding definitions in nsMsgContentPolicy.cpp
+const kNoRemoteContentPolicy = 0;
+const kBlockRemoteContent = 1;
+const kAllowRemoteContent = 2;
+
+const kIsAPhishMessage = 0;
+const kNotAPhishMessage = 1;
+
+const kMsgNotificationNoStatus = 0;
+const kMsgNotificationJunkBar = 1;
+const kMsgNotificationRemoteImages = 2;
+const kMsgNotificationPhishingBar = 3;
+
 var gMessengerBundle;
 var gPromptService;
 var gOfflinePromptsBundle;
@@ -2049,40 +2066,143 @@ function HandleJunkStatusChanged(folder)
   var loadedMessage = GetLoadedMessage();
   if (loadedMessage && (!(/type=x-message-display/.test(loadedMessage))) && IsCurrentLoadedFolder(folder))
   {
-    var messageURI = GetLoadedMessage();
-    // if multiple message are selected
-    // and we change the junk status
-    // we don't want to show the junk bar
-    // (since the message pane is blank)
-    if (messageURI && (GetNumSelectedMessages() == 1))
-      SetUpJunkBar(messenger.messageServiceFromURI(messageURI).messageURIToMsgHdr(messageURI));
-    else
-      SetUpJunkBar(null);
+    // if multiple message are selected and we change the junk status
+    // we don't want to show the junk bar (since the message pane is blank)
+    var msgHdr = null;
+    if (GetNumSelectedMessages() == 1)
+      msgHdr = messenger.messageServiceFromURI(loadedMessage).messageURIToMsgHdr(loadedMessage);
+    gMessageNotificationBar.setJunkMsg(msgHdr);
   }
 }
 
-function SetUpJunkBar(aMsgHdr)
+var gMessageNotificationBar = 
 {
-  // XXX todo
-  // should this happen on the start, or at the end?
-  // if at the end, we might keep the "this message is junk" up for a while, until a big message is loaded
-  // or do we need to wait until here, to make sure the message is fully analyzed
-  // what about almost hiding it on the start, and then showing here?
+  mBarStatus: 0,
+  // flag bit values for mBarStatus, indexed by kMsgNotificationXXX
+  mBarFlagValues: [
+                    0, // kMsgNotificationNoStatus
+                    1, // 1 << (kMsgNotificationJunkBar - 1)
+                    2, // 1 << (kMsgNotificationRemoteImages - 1)
+                    4  // 1 << (kMsgNotificationPhishingBar - 1)
+                  ],
 
-  var isJunk = false;
+  mMsgNotificationBar: document.getElementById('msgNotificationBar'),
+
+  setJunkMsg: function(aMsgHdr)
+  {
+    var isJunk = false;
+    var isCurrentlyNotJunk = this.mMsgNotificationBar.selectedIndex != kMsgNotificationJunkBar;
   
-  if (aMsgHdr) {
-    var junkScore = aMsgHdr.getStringProperty("junkscore"); 
-    isJunk = ((junkScore != "") && (junkScore != "0"));
+    if (aMsgHdr) 
+    {
+      var junkScore = aMsgHdr.getStringProperty("junkscore"); 
+      isJunk = ((junkScore != "") && (junkScore != "0"));
+    }
+
+    this.updateMsgNotificationBar (kMsgNotificationJunkBar, isJunk);
+
+    goUpdateCommand('button_junk');
+  },
+
+  setRemoteContentMsg: function(aMsgHdr)
+  {  
+    var blockRemote = aMsgHdr &&
+                      aMsgHdr.getUint32Property("remoteContentPolicy") == kBlockRemoteContent;
+    this.updateMsgNotificationBar(kMsgNotificationRemoteImages, blockRemote);
+  },
+
+  // aUrl is the nsIURI for the message currently loaded in the message pane
+  setPhishingMsg: function(aUrl)
+  {
+    // if we've explicitly marked this message as not being an email scam, then don't
+    // bother checking it with the phishing detector.
+    var phishingMsg = false;
+    if (!checkMsgHdrPropertyIsNot("notAPhishMessage", kIsAPhishMessage))
+      phishingMsg = isMsgEmailScam(aUrl);
+    this.updateMsgNotificationBar(kMsgNotificationPhishingBar, phishingMsg);
+  },
+
+  clearMsgNotifications: function()
+  {
+    this.updateMsgNotificationBar(kMsgNotificationNoStatus, true);
+  },
+
+  // private method used to set our message notification deck to the correct value...
+  updateMsgNotificationBar: function(aIndex, aSet)
+  {
+    var chunk = this.mBarFlagValues[aIndex];
+    var status = aSet ? this.mBarStatus | chunk : this.mBarStatus & ~chunk;
+    this.mBarStatus = status;
+
+    // the junk message takes precedence over the phishing message
+    // which takes precedence over the remote content message
+    if (status & this.mBarFlagValues[kMsgNotificationJunkBar])
+      aIndex = kMsgNotificationJunkBar;
+    else if (status & this.mBarFlagValues[kMsgNotificationPhishingBar])
+      aIndex = kMsgNotificationPhishingBar;
+    else if (status & this.mBarFlagValues[kMsgNotificationRemoteImages])
+      aIndex = kMsgNotificationRemoteImages;
+    else
+      aIndex = kMsgNotificationNoStatus;
+
+    if (status == kMsgNotificationNoStatus)
+      this.mMsgNotificationBar.setAttribute('collapsed', true);
+    else
+      this.mMsgNotificationBar.removeAttribute('collapsed');
+    
+    this.mMsgNotificationBar.selectedIndex = aIndex;
   }
-  
-  var junkBar = document.getElementById("junkBar");
-  if (isJunk)
-    junkBar.removeAttribute("collapsed");
-  else
-    junkBar.setAttribute("collapsed","true");
- 
-  goUpdateCommand('button_junk');
+};
+
+function LoadMsgWithRemoteContent()
+{
+  // we want to get the msg hdr for the currently selected message
+  // change the "remoteContentBar" property on it
+  // then reload the message
+
+  setMsgHdrPropertyAndReload("remoteContentPolicy", kAllowRemoteContent);
+}
+
+function MsgIsNotAScam()
+{
+  // we want to get the msg hdr for the currently selected message
+  // change the "isPhishingMsg" property on it
+  // then reload the message
+
+  setMsgHdrPropertyAndReload("notAPhishMessage", kNotAPhishMessage);
+}
+
+function setMsgHdrPropertyAndReload(aProperty, aValue)
+{
+  // we want to get the msg hdr for the currently selected message
+  // change the appropiate property on it then reload the message
+
+  var msgURI = GetLoadedMessage();
+
+  if (msgURI && !(/type=x-message-display/.test(msgURI)))
+  {
+    var msgHdr = messenger.messageServiceFromURI(msgURI).messageURIToMsgHdr(msgURI);
+    if (msgHdr)
+    {
+      msgHdr.setUint32Property(aProperty, aValue);
+      MsgReload();
+    }
+  }
+}
+
+function checkMsgHdrPropertyIsNot(aProperty, aValue)
+{
+  // we want to get the msg hdr for the currently selected message,
+  // get the appropiate property on it and then test against value.
+
+  var msgURI = GetLoadedMessage();
+    
+  if (msgURI && !(/type=x-message-display/.test(msgURI)))
+  {
+    var msgHdr = messenger.messageServiceFromURI(msgURI).messageURIToMsgHdr(msgURI);
+    return (msgHdr && msgHdr.getUint32Property(aProperty) != aValue);
+  }
+  return false;
 }
 
 function MarkCurrentMessageAsRead()
@@ -2099,6 +2219,11 @@ function ClearPendingReadTimer()
   }
 }
 
+function OnMsgParsed(aUrl)
+{
+  gMessageNotificationBar.setPhishingMsg(aUrl);
+}
+
 function OnMsgLoaded(aUrl)
 {
     if (!aUrl)
@@ -2117,14 +2242,11 @@ function OnMsgLoaded(aUrl)
     // SetNextMessageAfterDelete() when the operation completes (bug 243532).
     gNextMessageViewIndexAfterDelete = -2;
 
-    if (/type=x-message-display/.test(msgURI))
-      SetUpJunkBar(null);
-    else
-    {
+    if (!(/type=x-message-display/.test(msgURI)))
       msgHdr = messenger.messageServiceFromURI(msgURI).messageURIToMsgHdr(msgURI);
-      SetUpJunkBar(msgHdr);
-    }
-    
+
+    gMessageNotificationBar.setJunkMsg(msgHdr);
+
     // we just finished loading a message. set a timer to actually mark the message as read after n seconds
     // where n can be configured by the user.
     var markReadOnADelay = gPrefBranch.getBoolPref("mailnews.mark_message_read.delay");
@@ -2324,5 +2446,3 @@ function OpenOrFocusWindow(args, windowType, chromeURL)
   else
     window.openDialog(chromeURL, "", "chrome,resizable,status,centerscreen,dialog=no", args);
 }
-
-
diff --git a/mozilla/mailnews/base/resources/content/mailWindowOverlay.xul b/mozilla/mailnews/base/resources/content/mailWindowOverlay.xul
index fd8061409ef..fdf09b03d7b 100644
--- a/mozilla/mailnews/base/resources/content/mailWindowOverlay.xul
+++ b/mozilla/mailnews/base/resources/content/mailWindowOverlay.xul
@@ -280,6 +280,8 @@
     <command id="cmd_markAsJunk" oncommand="goDoCommand('cmd_markAsJunk'); event.preventBubble()" disabled="true"/>
     <command id="cmd_markAsNotJunk" oncommand="goDoCommand('cmd_markAsNotJunk'); event.preventBubble()" disabled="true"/>
     <command id="cmd_recalculateJunkScore" oncommand="goDoCommand('cmd_recalculateJunkScore');" disabled="true"/>
+    <command id="cmd_markAsShowRemote" oncommand="goDoCommand('cmd_markAsShowRemote'); event.preventBubble()" disabled="true"/>
+    <command id="cmd_markAsNotPhish" oncommand="goDoCommand('cmd_markAsNotPhish'); event.preventBubble()" disabled="true"/>
 </commandset>
 
 <commandset id="mailLabelMenuItems"
@@ -328,6 +330,10 @@
   <key id="key_markJunk" key="&markAsJunkCmd.key;"                   oncommand="goDoCommand('cmd_markAsJunk');"/>
   <key id="key_markNotJunk" key="&markAsNotJunkCmd.key;"             oncommand="goDoCommand('cmd_markAsNotJunk');"
        modifiers="shift"/>
+  <key id="key_markShowRemote" key="&markAsShowRemoteCmd.key;"       oncommand="goDoCommand('cmd_markAsShowRemote');"
+       modifiers="shift"/>
+  <key id="key_markNotPhish" key="&markAsNotPhishCmd.key;"           oncommand="goDoCommand('cmd_markAsNotPhish');"
+       modifiers="shift"/>
   <key id="key_markAllRead" key="&markAllReadCmd.key;"               oncommand="goDoCommand('cmd_markAllRead');" modifiers="accel, shift"/>
   <key id="key_markThreadAsRead" key="&markThreadAsReadCmd.key;"     oncommand="goDoCommand('cmd_markThreadAsRead')"/>
   <key id="key_markReadByDate" key="&markReadByDateCmd.key;"         oncommand="goDoCommand('cmd_markReadByDate')"/>
@@ -633,6 +639,12 @@
         <menuitem label="&recalculateJunkScoreCmd.label;"
                   accesskey="&recalculateJunkScoreCmd.accesskey;"
                   command="cmd_recalculateJunkScore"/>
+        <menuitem label="&markAsShowRemoteCmd.label;"
+                  accesskey="&markAsShowRemoteCmd.accesskey;"
+                  command="cmd_markAsShowRemote"/>
+        <menuitem label="&markAsNotPhishCmd.label;"
+                  accesskey="&markAsNotPhishCmd.accesskey;"
+                  command="cmd_markAsNotPhish"/>
       </menupopup>
     </menu>
     <menuseparator/>
@@ -977,6 +989,12 @@
         <menuitem label="&recalculateJunkScoreCmd.label;"
                   accesskey="&recalculateJunkScoreCmd.accesskey;"
                   command="cmd_recalculateJunkScore"/>
+        <menuitem label="&markAsShowRemoteCmd.label;"
+                  accesskey="&markAsShowRemoteCmd.accesskey;"
+                  command="cmd_markAsShowRemote"/>
+        <menuitem label="&markAsNotPhishCmd.label;"
+                  accesskey="&markAsNotPhishCmd.accesskey;"
+                  command="cmd_markAsNotPhish"/>
       </menupopup>
     </menu>
     <menuseparator id="messagePaneContext-sep-labels-2"/>
@@ -1610,6 +1628,14 @@
         <menuitem label="&recalculateJunkScoreCmd.label;"
                   accesskey="&recalculateJunkScoreCmd.accesskey;"
                   command="cmd_recalculateJunkScore"/>
+        <menuitem label="&markAsShowRemoteCmd.label;"
+                  key="key_markShowRemote"
+                  accesskey="&markAsShowRemoteCmd.accesskey;"
+                  command="cmd_markAsShowRemote"/>
+        <menuitem label="&markAsNotPhishCmd.label;"
+                  key="key_markNotPhish"
+                  accesskey="&markAsNotPhishCmd.accesskey;"
+                  command="cmd_markAsNotPhish"/>
       </menupopup>
     </menu>
     <menuseparator/>
@@ -1827,13 +1853,34 @@
           accesskey="&advancedButton.accesskey;"/>
 </hbox>
 
-<hbox id="junkBar" collapsed="true" align="center">
-  <image id="junkBarImage"/>
-  <label id="junkBarMessage" value="&junkBarMessage.label;"/>
-  <spacer flex="1"/>
-  <button label="&junkInfoButton.label;" oncommand="MsgJunkMailInfo(false)"/>
-  <button label="&junkBarButton.label;" oncommand="JunkSelectedMessages(false)"/>
-</hbox>
+<!-- The msgNotificationBar appears on top of the message and displays 
+     information like: junk, contains remote images, or is a suspected phishing URL 
+-->
+<deck id="msgNotificationBar" selectedIndex="0" collapsed="true">
+  <hbox id="msgNotificationNoStatus"/>
+
+  <hbox id="junkBar" class="msgNotificationBar" align="center">
+    <image id="junkBarImage"/>
+    <description flex="1" class="msgNotificationBarText">&junkBarMessage.label;</description>
+    <spacer flex="1"/>
+    <button label="&junkInfoButton.label;" oncommand="MsgJunkMailInfo(false)"/>
+    <button label="&junkBarButton.label;" oncommand="JunkSelectedMessages(false);"/>
+  </hbox>
+
+  <hbox id="remoteContentBar" class="msgNotificationBar" align="center">
+    <image id="remoteContentImage"/>
+    <description flex="1" class="msgNotificationBarText">&remoteContentMessage.label;</description>
+    <spacer flex="1"/>
+    <button label="&loadRemoteContentButton.label;" oncommand="LoadMsgWithRemoteContent();"/>
+  </hbox>
+
+  <hbox id="phishingBar" class="msgNotificationBar" align="center">
+    <image id="phishingBarImage"/>
+    <description flex="1" class="msgNotificationBarText">&phishingBarMessage.label;</description>
+    <spacer flex="1"/>
+    <button label="&removePhishingBarButton.label;" oncommand="MsgIsNotAScam();"/>
+  </hbox>
+</deck>
 
 <statusbar class="chromeclass-status" id="status-bar"> 
   <statusbarpanel id="component-bar"/>
diff --git a/mozilla/mailnews/base/resources/content/messageWindow.js b/mozilla/mailnews/base/resources/content/messageWindow.js
index b101ff9d4a3..fd778aa4979 100644
--- a/mozilla/mailnews/base/resources/content/messageWindow.js
+++ b/mozilla/mailnews/base/resources/content/messageWindow.js
@@ -655,6 +655,8 @@ var MessageWindowController =
       case "cmd_markAsJunk":
       case "cmd_markAsNotJunk":
       case "cmd_recalculateJunkScore":
+      case "cmd_markAsShowRemote":
+      case "cmd_markAsNotPhish":
       case "cmd_applyFilters":
       case "cmd_runJunkControls":
       case "cmd_deleteJunk":
@@ -753,6 +755,10 @@ var MessageWindowController =
       case "button_file":
 			case "cmd_file":
         return (gCurrentMessageUri != null);
+      case "cmd_markAsShowRemote":
+        return (GetNumSelectedMessages() > 0 && checkMsgHdrPropertyIsNot("remoteContentPolicy", kAllowRemoteContent));
+      case "cmd_markAsNotPhish":
+        return (GetNumSelectedMessages() > 0 && checkMsgHdrPropertyIsNot("notAPhishMessage", kNotAPhishMessage));
 			case "cmd_printSetup":
 			  return true;
 			case "cmd_getNewMessages":
@@ -921,6 +927,12 @@ var MessageWindowController =
       case "cmd_recalculateJunkScore":
         analyzeMessagesForJunk();
         return;
+      case "cmd_markAsShowRemote":
+        LoadMsgWithRemoteContent();
+        return;
+      case "cmd_markAsNotPhish":
+        MsgIsNotAScam();
+        return;
       case "cmd_label0":
         gDBView.doCommand(nsMsgViewCommandType.label0);
  				return;
diff --git a/mozilla/mailnews/base/resources/content/messageWindow.xul b/mozilla/mailnews/base/resources/content/messageWindow.xul
index 140a285cde2..90dc9334fe0 100644
--- a/mozilla/mailnews/base/resources/content/messageWindow.xul
+++ b/mozilla/mailnews/base/resources/content/messageWindow.xul
@@ -76,6 +76,7 @@
   <script type="application/x-javascript" src="chrome://messenger/content/messageWindow.js"/>
   <script type="application/x-javascript" src="chrome://messenger/content/accountUtils.js"/>
   <script type="application/x-javascript" src="chrome://messenger/content/mailContextMenus.js"/>
+  <script type="application/x-javascript" src="chrome://messenger/content/phishingDetector.js"/>
   <script type="application/x-javascript" src="chrome://communicator/content/contentAreaClick.js"/>
   <script type="application/x-javascript" src="chrome://global/content/nsTransferable.js"/>
   <script type="application/x-javascript" src="chrome://global/content/nsDragAndDrop.js"/>
@@ -147,7 +148,7 @@
         ondragdrop="nsDragAndDrop.drop(event, messagepaneObserver);"
         ondragexit="nsDragAndDrop.dragExit(event, messagepaneObserver);">
 
-    <hbox id="junkBar"/>
+    <deck id="msgNotificationBar"/>
 
     <hbox id="msgHeaderView"/>
 
@@ -155,7 +156,7 @@
     <browser id="messagepane" context="messagePaneContext" 
       style="height: 0px; min-height: 1px" flex="1" name="messagepane" 
       disablesecurity="true" disablehistory="true" type="content-primary" 
-      src="about:blank" onclick="messagePaneOnClick(event);" autofind="false"/>
+      src="about:blank" onclick="return messagePaneOnClick(event);" autofind="false"/>
   </vbox>  
 </vbox>
 
diff --git a/mozilla/mailnews/base/resources/content/messenger.xul b/mozilla/mailnews/base/resources/content/messenger.xul
index cdc1f921ddd..ce45530906c 100644
--- a/mozilla/mailnews/base/resources/content/messenger.xul
+++ b/mozilla/mailnews/base/resources/content/messenger.xul
@@ -84,6 +84,7 @@
 <script type="application/x-javascript" src="chrome://messenger/content/messengerdnd.js"/>
 <script type="application/x-javascript" src="chrome://messenger/content/accountUtils.js"/>
 <script type="application/x-javascript" src="chrome://messenger/content/mail-offline.js"/>
+<script type="application/x-javascript" src="chrome://messenger/content/phishingDetector.js"/>
 <script type="application/x-javascript" src="chrome://communicator/content/contentAreaClick.js"/>
 <script type="application/x-javascript" src="chrome://global/content/nsTransferable.js"/>
 <script type="application/x-javascript" src="chrome://global/content/nsDragAndDrop.js"/>
@@ -182,14 +183,14 @@
         </splitter>
 
         <vbox id="messagepanebox" flex="2" minheight="100" height="200" minwidth="100" width="200" persist="collapsed height width" class="window-focusborder" focusring="false">
-          <hbox id="junkBar"/>
+          <deck id="msgNotificationBar"/>
 
           <hbox id="msgHeaderView"/>
 
           <browser id="messagepane" name="messagepane" height="0" flex="1"
                    context="messagePaneContext" minwidth="1" minheight="1"
                    disablesecurity="true" disablehistory="true" autofind="false"
-                   type="content-primary" onclick="messagePaneOnClick(event);"/>
+                   type="content-primary" onclick="return messagePaneOnClick(event);"/>
         </vbox>
       </box>
     </box>
diff --git a/mozilla/mailnews/base/resources/content/msgHdrViewOverlay.js b/mozilla/mailnews/base/resources/content/msgHdrViewOverlay.js
index 279ed29846e..b413e1bd37e 100644
--- a/mozilla/mailnews/base/resources/content/msgHdrViewOverlay.js
+++ b/mozilla/mailnews/base/resources/content/msgHdrViewOverlay.js
@@ -293,6 +293,7 @@ var messageHeaderSink = {
       gBuildAttachmentPopupForCurrentMsg = true;
       ClearAttachmentList();
       ClearEditMessageButton();
+      gMessageNotificationBar.clearMsgNotifications();
 
       for (var index in gMessageListeners)
         gMessageListeners[index].onStartHeaders();
@@ -443,6 +444,7 @@ var messageHeaderSink = {
 
     onEndMsgDownload: function(url)
     {
+      OnMsgParsed(url);
     },
 
     onEndMsgHeaders: function(url)
@@ -452,6 +454,7 @@ var messageHeaderSink = {
     
     onMsgHasRemoteContent: function(aMsgHdr)
     {
+      gMessageNotificationBar.setRemoteContentMsg(aMsgHdr);
     },
 
     mSecurityInfo  : null,
diff --git a/mozilla/mailnews/base/resources/content/msgMail3PaneWindow.js b/mozilla/mailnews/base/resources/content/msgMail3PaneWindow.js
index 6658f98b283..937abaa00d9 100644
--- a/mozilla/mailnews/base/resources/content/msgMail3PaneWindow.js
+++ b/mozilla/mailnews/base/resources/content/msgMail3PaneWindow.js
@@ -1130,11 +1130,10 @@ function ClearMessagePane()
     gCurrentDisplayedMessage = null;
     if (GetMessagePaneFrame().location.href != "about:blank")
         GetMessagePaneFrame().location.href = "about:blank";
+
     // hide the message header view AND the message pane...
     HideMessageHeaderPane();
-
-    // hide the junk bar
-    SetUpJunkBar(null);
+    gMessageNotificationBar.clearMsgNotifications();
   }
 }
 
diff --git a/mozilla/mailnews/base/resources/content/phishingDetector.js b/mozilla/mailnews/base/resources/content/phishingDetector.js
new file mode 100755
index 00000000000..66fe8bb4148
--- /dev/null
+++ b/mozilla/mailnews/base/resources/content/phishingDetector.js
@@ -0,0 +1,239 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Thunderbird Phishing Dectector
+ *
+ * The Initial Developer of the Original Code is
+ * The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2005
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Scott MacGregor <mscott@mozilla.org>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ****** */
+
+// Dependencies:
+// gPrefBranch, gBrandBundle, gMessengerBundle should already be defined
+// gatherTextUnder from utilityOverlay.js
+
+const kPhishingNotSuspicious = 0;
+const kPhishingWithIPAddress = 1;
+const kPhishingWithMismatchedHosts = 2;
+
+//////////////////////////////////////////////////////////////////////////////
+// isEmailScam --> examines the message currently loaded in the message pane
+//                 and returns true if we think that message is an e-mail scam.
+//                 Assumes the message has been completely loaded in the message pane (i.e. OnMsgParsed has fired)
+// aUrl: nsIURI object for the msg we want to examine...
+//////////////////////////////////////////////////////////////////////////////
+function isMsgEmailScam(aUrl)
+{
+  var isEmailScam = false; 
+  if (!aUrl || !gPrefBranch.getBoolPref("mail.phishing.detection.enabled"))
+    return isEmailScam;
+
+  // Ignore nntp and RSS messages
+  var folder = aUrl.folder;
+  if (folder.server.type == 'nntp' || folder.server.type == 'rss')
+    return isEmailScam;
+
+  // loop through all of the link nodes in the message's DOM, looking for phishing URLs...
+  var msgDocument = document.getElementById('messagepane').contentDocument;
+
+  // examine all anchor tags...
+  var anchorNodes = msgDocument.getElementsByTagName("a");
+  for (var index = 0; index < anchorNodes.length && !isEmailScam; index++)
+    isEmailScam = isPhishingURL(anchorNodes[index], true);
+
+  // if an e-mail contains a non-addressbook form element, then assume the message is
+  // a phishing attack. Legitimate sites should not be using forms inside of e-mail
+  if (!isEmailScam)
+  {
+    var forms = msgDocument.getElementsByTagName("form");
+    for (var i = 0; i < forms.length && !isEmailScam; i++)
+      isEmailScam = forms[i].action.search("addbook") != 0;
+  }
+
+  // we'll add more checks here as our detector matures....
+  return isEmailScam;
+}
+
+//////////////////////////////////////////////////////////////////////////////
+// isPhishingURL --> examines the passed in linkNode and returns true if we think
+//                   the URL is an email scam.
+// aLinkNode: the link node to examine
+// aSilentMode: don't prompt the user to confirm
+//////////////////////////////////////////////////////////////////////////////
+
+function isPhishingURL(aLinkNode, aSilentMode)
+{
+  if (!gPrefBranch.getBoolPref("mail.phishing.detection.enabled"))
+    return false;
+
+  var phishingType = kPhishingNotSuspicious;
+  var href = aLinkNode.href;
+  if (!href)
+    return false;
+
+  var linkTextURL = {};
+  var unobscuredHostName = {};
+  var isPhishingURL = false;
+
+  var ioService = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
+  hrefURL  = ioService.newURI(href, null, null);
+  
+  // only check for phishing urls if the url is an http or https link.
+  // this prevents us from flagging imap and other internally handled urls
+  if (hrefURL.schemeIs('http') || hrefURL.schemeIs('https'))
+  {
+    unobscuredHostName.value = hrefURL.host;
+
+    if (hostNameIsIPAddress(hrefURL.host, unobscuredHostName))
+      phishingType = kPhishingWithIPAddress;
+    else if (misMatchedHostWithLinkText(aLinkNode, hrefURL, linkTextURL))
+      phishingType = kPhishingWithMismatchedHosts;
+
+    isPhishingURL = phishingType != kPhishingNotSuspicious;
+
+    if (!aSilentMode && isPhishingURL) // allow the user to override the decision
+      isPhishingURL = confirmSuspiciousURL(phishingType, unobscuredHostName.value);
+  }
+
+  return isPhishingURL;
+}
+
+//////////////////////////////////////////////////////////////////////////////
+// helper methods in support of isPhishingURL
+//////////////////////////////////////////////////////////////////////////////
+
+function misMatchedHostWithLinkText(aLinkNode, aHrefURL, aLinkTextURL)
+{
+  var linkNodeText = gatherTextUnder(aLinkNode);
+  // only worry about http and https urls
+  if (linkNodeText)
+  {
+    // does the link text look like a http url?
+     if (linkNodeText.search(/(^http:|^https:)/) != -1)
+     {
+       var ioService = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
+       linkTextURL  = ioService.newURI(linkNodeText, null, null);
+       aLinkTextURL.value = linkTextURL;
+       return aHrefURL.host != linkTextURL.host;
+     }
+  }
+
+  return false;
+}
+
+// returns true if the hostName is an IP address
+// if the host name is an obscured IP address, returns the unobscured host
+function hostNameIsIPAddress(aHostName, aUnobscuredHostName)
+{
+  // TODO: Add Support for IPv6
+
+  var index;
+
+  // scammers frequently obscure the IP address by encoding each component as octal, hex
+  // or in some cases a mix match of each. The IP address could also be represented as a DWORD.
+
+  // break the IP address down into individual components.
+  var ipComponents = aHostName.split(".");
+
+  // if we didn't find at least 4 parts to our IP address it either isn't a numerical IP
+  // or it is encoded as a dword
+  if (ipComponents.length < 4)
+  {
+    // Convert to a binary to test for possible DWORD.
+    var binaryDword = parseInt(aHostName).toString(2);
+
+    if (isNaN(binaryDword))
+      return false;
+
+    // convert the dword into its component IP parts.
+    ipComponents =
+    [
+      (aHostName >> 24) & 255,
+      (aHostName >> 16) & 255,
+      (aHostName >>  8) & 255,
+      (aHostName & 255)
+    ];
+  }
+  else
+  {
+    for (index = 0; index < ipComponents.length; index++)
+    {
+      // by leaving the radix parameter blank, we can handle IP addresses
+      // where one component is hex, another is octal, etc.
+      ipComponents[index] = parseInt(ipComponents[index]);
+    }
+  }
+
+  // make sure each part of the IP address is in fact a number
+  for (index = 0; index < ipComponents.length; index++)
+    if (isNaN(ipComponents[index])) // if any part of the IP address is not a number, then we can safely return
+      return false;
+
+  // only set aUnobscuredHostName if we are looking at an IPv4 host name
+  var hostName = ipComponents.join(".");
+  if (isIPv4HostName(hostName))
+  {
+    aUnobscuredHostName.value = hostName;
+    return true;
+  }
+
+  return false;
+}
+
+function isIPv4HostName(aHostName)
+{
+  var ipv4HostRegExp = new RegExp(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/);  // IPv4
+  // treat 0.0.0.0 as an invalid IP address
+  return ipv4HostRegExp.test(aHostName) && aHostName != '0.0.0.0';
+}
+
+// returns true if the user confirms the URL is a scam
+function confirmSuspiciousURL(aPhishingType, aSuspiciousHostName)
+{
+  var brandShortName = gBrandBundle.getString("brandShortName");
+  var titleMsg = gMessengerBundle.getString("confirmPhishingTitle");
+  var dialogMsg = null;
+
+  switch (aPhishingType)
+  {
+    case kPhishingWithIPAddress:
+    case kPhishingWithMismatchedHosts:
+      dialogMsg = gMessengerBundle.getFormattedString("confirmPhishingUrl" + aPhishingType, [brandShortName, aSuspiciousHostName], 2);
+      break;
+    default:
+      return false;
+  }
+
+  const nsIPS = Components.interfaces.nsIPromptService;
+  var promptService = Components.classes["@mozilla.org/embedcomp/prompt-service;1"].getService(nsIPS);
+  var buttons = nsIPS.STD_YES_NO_BUTTONS + nsIPS.BUTTON_POS_1_DEFAULT;
+  return promptService.confirmEx(window, titleMsg, dialogMsg, buttons, "", "", "", "", {}); /* the yes button is in position 0 */
+}
diff --git a/mozilla/mailnews/base/resources/locale/en-US/messenger.dtd b/mozilla/mailnews/base/resources/locale/en-US/messenger.dtd
index 9cabee8115d..e5834754c98 100644
--- a/mozilla/mailnews/base/resources/locale/en-US/messenger.dtd
+++ b/mozilla/mailnews/base/resources/locale/en-US/messenger.dtd
@@ -437,6 +437,12 @@
 <!ENTITY markAsNotJunkCmd.key "j">
 <!ENTITY recalculateJunkScoreCmd.label "Run Junk Mail Controls">
 <!ENTITY recalculateJunkScoreCmd.accesskey "C">
+<!ENTITY markAsShowRemoteCmd.label "Show Remote Content">
+<!ENTITY markAsShowRemoteCmd.accesskey "e">
+<!ENTITY markAsShowRemoteCmd.key "r">
+<!ENTITY markAsNotPhishCmd.label "As Not Scam">
+<!ENTITY markAsNotPhishCmd.accesskey "S">
+<!ENTITY markAsNotPhishCmd.key "p">
 <!ENTITY openMessageWindowCmd.label "Open Message">
 <!ENTITY openMessageWindowCmd.accesskey "O">
 <!ENTITY openMessageWindowCmd.key "o">
@@ -585,8 +591,15 @@
 <!ENTITY deleteJunk.label "Delete Mail Marked as Junk in Folder">
 <!ENTITY deleteJunk.accesskey "e">
 
-<!-- junk bar -->
-<!ENTITY junkBarMessage.label "&brandShortName; thinks this message is junk mail">
+<!-- Junk Bar -->
+<!ENTITY junkBarMessage.label "&brandShortName; thinks this message is junk.">
 <!ENTITY junkBarButton.label "This is Not Junk">
 <!ENTITY junkInfoButton.label "?">
 
+<!-- Remote Content Bar -->
+<!ENTITY remoteContentMessage.label "To protect your privacy, &brandShortName; has blocked remote content in this message.">
+<!ENTITY loadRemoteContentButton.label "Show Remote Content">
+
+<!-- Phishing Bar -->
+<!ENTITY phishingBarMessage.label "&brandShortName; thinks this message might be an email scam.">
+<!ENTITY removePhishingBarButton.label "Not a Scam">
diff --git a/mozilla/mailnews/base/resources/locale/en-US/messenger.properties b/mozilla/mailnews/base/resources/locale/en-US/messenger.properties
index 26d858752d7..de5433c60a4 100644
--- a/mozilla/mailnews/base/resources/locale/en-US/messenger.properties
+++ b/mozilla/mailnews/base/resources/locale/en-US/messenger.properties
@@ -365,3 +365,9 @@ alertNoSearchFoldersSelected=You must choose at least one folder to search for t
 # LOCALIZATION NOTES(????ByteAbbreviation): Do not translate %d below, it is the size of the message/folder
 kiloByteAbbreviation=%dKB
 megaByteAbbreviation=%dMB
+
+# Warnings to alert users about phishing urls
+confirmPhishingTitle=Email Scam Alert
+#LOCALIZATION NOTE %1$S is the brand name, %2$S is the host name of the url being visited
+confirmPhishingUrl1=%1$S thinks this site is suspicious! It may be trying to impersonate the web page you want to visit. Most legitimate sites use names instead of numbers. Are you sure you want to visit %2$S?
+confirmPhishingUrl2=%1$S thinks this site is suspicious! It may be trying to impersonate the web page you want to visit. Are you sure you want to visit %2$S?
diff --git a/mozilla/mailnews/jar.mn b/mozilla/mailnews/jar.mn
index 8d29230c7bd..282e793255f 100644
--- a/mozilla/mailnews/jar.mn
+++ b/mozilla/mailnews/jar.mn
@@ -143,6 +143,7 @@ messenger.jar:
     content/messenger/junkMail.xul                                             (base/resources/content/junkMail.xul)
     content/messenger/junkMail.js                                              (base/resources/content/junkMail.js)
 *   content/messenger/junkMailInfo.xul                                         (base/resources/content/junkMailInfo.xul)
+    content/messenger/phishingDetector.js                                      (base/resources/content/phishingDetector.js)
     content/messenger/SearchDialog.xul                                         (base/search/resources/content/SearchDialog.xul)
     content/messenger/ABSearchDialog.xul                                       (base/search/resources/content/ABSearchDialog.xul)
     content/messenger/SearchDialog.js                                          (base/search/resources/content/SearchDialog.js)
diff --git a/mozilla/mailnews/mailnews.js b/mozilla/mailnews/mailnews.js
index 59a1b92023f..6a3f8e96ac4 100644
--- a/mozilla/mailnews/mailnews.js
+++ b/mozilla/mailnews/mailnews.js
@@ -518,6 +518,7 @@ pref("news.cancel.confirm",true);
 pref("news.cancel.alert_on_success",true);
 pref("mail.SpellCheckBeforeSend",false);
 pref("mail.spellcheck.inline",true);
+pref("mail.phishing.detection.enabled", true); // enable / disable phishing detection for link clicks
 pref("mail.warn_on_send_accel_key", true);
 pref("mail.enable_autocomplete",true);
 pref("mailnews.html_domains","");
diff --git a/mozilla/themes/classic/jar.mn b/mozilla/themes/classic/jar.mn
index a8dff6b72a6..ef89bcc2521 100644
--- a/mozilla/themes/classic/jar.mn
+++ b/mozilla/themes/classic/jar.mn
@@ -429,6 +429,7 @@ classic.jar:
   skin/classic/messenger/icons/message-news-new-attach-off.gif          (messenger/icons/message-news-new-attach-off.gif)
   skin/classic/messenger/icons/message-news-new-offl.gif                (messenger/icons/message-news-new-offl.gif)
   skin/classic/messenger/icons/message-news-offl.gif                    (messenger/icons/message-news-offl.gif)
+  skin/classic/messenger/icons/remote-blocked.png                       (messenger/icons/remote-blocked.png)
   skin/classic/messenger/icons/server-local.gif                         (messenger/icons/server-local.gif)
   skin/classic/messenger/icons/server-local-new.gif                     (messenger/icons/server-local-new.gif)
   skin/classic/messenger/icons/server-mail.gif                          (messenger/icons/server-mail.gif)
diff --git a/mozilla/themes/classic/messenger/icons/remote-blocked.png b/mozilla/themes/classic/messenger/icons/remote-blocked.png
new file mode 100755
index 0000000000000000000000000000000000000000..552c93f7a2453ef271d03496f4240edddcf2d780
GIT binary patch
literal 2205
zcmV;O2x9k%P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F800009a7bBm002%P
z002%P0Tz9k-T(jyPf0{URCt`NmdkHkR~^Sc_s*U7+?nw!w#QCl=S>rbkkS{W4`?Ms
zi$qzlfd!BS%7P-cNT5ipSt9WVAR%ReS{5Z$Tbj0t3T<)Ppu|lbKN64a@pwG%=bd}b
z@30tqYNrXUpuf>w+;h+G_x+yl?=i>XOSTtZd@-z)8q->5Y}?K#r7~LUj4>u-j2T;5
zS^4ed%a>;X4d8syz!xrDaDaV4Mr)nXT4zKgBO)1NO#dAi8XO$7UDqX<OyasOsZ@$|
zI?bg^mw4~J_f~=50675X!i5X=;NakpWmy>@<NJQb7}F0fA{ni91{jG%BEfh(PCOnb
zkx1aWF0Sj6NF+$5QY4c}5{U$XK;WK-xN_wR-EMaji0rI6V`F3aU@$lojYh3#G)gQM
zBNmIX0~C+Pab1^qJWe1Gz_P4+1~(WK9v!N5Y0{;IXBxDvCQ*~(fb~_h);rt#K^zeo
zK6mcieFN_V7rJz5qG+LL(=}~;Ya58x_BS8FpfLyru>`>|WKH#BiO8PV&h7=D5}Fp8
zHrjOXtrnUNUE1h=aM=}HdhY_#)kxT&t!?n_eLMSiz>P8YC(vZB2aX_C&)FdT6ZOG&
zex4A$Bt))<Xl=GA2g+2RP$YgZ+V>X>W*33G&DoWgJs_V4Zag7#ahOCcg^Bw#2cpQ9
zrgL$XlAXnUA+tw`9Rhcguy-$*F9@y?;;-1a?IG;R5d!-Lh$dX3;TRz&g8!E-#Pq55
z2^eGUodRPFmSx=+yk3g2c4v@gBM453{YOe<=AtlSu*6`@-U61Khw3PZ+Gqr}3G7z;
zzA4xZ-fo7-&dzZA#yB0%qTYd8v(1O4C4P~ZBkWWOc?wZJtwxQO*TU<z@k1I3S$#!!
zEAU^tK<@^xhq?9o69oJi6N6Cqz^NIGglPp6lq*{(t+Aa5Z*Td$llNJuNAT>!IL-k^
zejOlltihS@z`p&TlY-p}2nMZT>77S#12G2DU<{P%ptVKIvuV2fxV@=ZER=b<Im+PJ
zIGJPPJQh#kI6;(F)S5MNSJs(*X_1GXtaJE$=iXhgw+MSVU;TIjubgIh1V#r9BGBnt
zgdK2fumU!J>^uMwn<vlAkV>QwZBPcZHaG!8Fc>54?qh25B)6`8$d7-1k#wl}Sq1ji
zKrd&Ti-!;a&xcCG!Wif(@C8H+^LK6#O~rWn%!7bMr~4_mh(Q~J)`AwWEr-L?53!yf
z;Nx2x2uTYz?pFgn=ar=t=@^u1;HzE=>MdxrV0nF&wpZo5k33E=Xyf}}jIfklU~Mx?
zvt1`(2S~faOpF~R7;+IYj0_#7-Fb{=W9!uB#_!Yj?E)o+N?jv5fYKJVR_|NWGgKRz
zx#b&t^YnuR>;S%R@Rb29+FqN@QVwG@#t7wFo|W}Ej!Zww$k1W57{*3t*vQWx7@K<j
zCmXk4SpaHx6`=-O;Y16R>%(~6AdX{$1xg8bHnJoWaZ<@N&5p*hEkql9Z8$!43K7lC
z<!czD!3bJ3pDetMZAWnvV<-dT<EJSV{{4O6&%pb4O+paMFnoN4O07h(T4SqHXRA`D
zSgDdLWSJNl?-$%ccA1T09x*-TrY2`Na$p9Gz_t>ieU?}Lf!dw{iR2XF=<uWyOg;>R
z?7M3~5We<ImQXU!R%MG~xj?a0pinAOZ&pdg-Cn_oA)CL=yC1zpZYzhcdL$+@GfeM4
zgE4{;g)u_CzCowcK#7Hz0HMf0Ad<+;0CD?XT@Z}>eD7B`89TW`u~MW^+@e_8!dD%f
zKnN`c(S~Nbj;}pFxc(;j;u>nZ3o_#~9GLhzMg%c}g{IZ6Zu<!VJA~szMu5a;2GPzW
zj1P2q;g?xzKefoNd4wVs7k?L}s}zpY>z05Wz!*U(&9%9|^Oa*ykxEXWlwoA_6uuZ%
zv+rO;umT}O3)&cz@=&T{0nR-q;f@jkB1|R+Ii5@tXNcK}c`A)6;cx=2g>+(sQYF_f
zxa&9H;OL>Jag+Pe+AuV75~YRB-1`JW186a50naO%PBUKxx_jDifJqz^BW|UMF+`9s
z)~DAu9-e9O@+<2Mr^nF(ljFx&S-*i&elO=*F@Nhdrl-G6JbAE3a_9jf@yXtR0-B8+
z?MAMty5$_u*rUKf9_n8gwbo?UvMenvvADR%!omW#7S_yK^(m$%Pg#x=BH%<harAMn
z-+U9Jdj+ROSX_LS$pg<2Pfnwh0V_eLD+B^I#lpX6l;^X+JkWGR1f>+~>+9UUeVgUw
zWtNtfSYBS1QmNFc)oRsBrBbR?D*0luxH@qxed6Zg<fA8!d;<|fIyuSdlh3iV^iQg_
zEEXEkLT>F{4unS$B4}d}W6^Hip;DObl=JU@1k3`yqm<I;&!4v{l}e*rE>}yXQn6Sp
z<_m?wYPZ|X0c*f2unrV9*WL{!(uZD)MpB0|V<*sJ5eW}-?D+F^l}Ec>!?GM~r#FH-
zz93>Ds>0gROD4ba<~6O`Zv(dgoU2!_J~uZv_pI;x&0SzQU<;@N9Y6sBP%qB1wKnx5
zt-Y7pUVVHba~3i7_Frv?P<RLt=@lGcW7BOdle_a**;sk~dZY5m8^GUy7W6V61d@Qa
z{U~<sQ1>_69X$K+_|&t1NTv>+9UVJurP9+FEAlD0XzKNKN`+a<g{$pC_VTqxW&RD|
zPur(AI|Tk$vw?%dli&K8J8=Am;qcI*NGu()>@cFbc%7nYH#cgH%6zuC@xe7r_buSn
zZI$~6{C^1SSR6PC!Lu=U;*{+~#zl23uU)8W)y&g7?Nwk2Xy5JpWf0i0AQ0Pr9KffS
f=N7%R-qZdAKESWDyj!DL00000NkvXXu0mjf$e<PS

literal 0
HcmV?d00001

diff --git a/mozilla/themes/classic/messenger/primaryToolbar.css b/mozilla/themes/classic/messenger/primaryToolbar.css
index 38bfa36fa13..25b3e1e5eba 100644
--- a/mozilla/themes/classic/messenger/primaryToolbar.css
+++ b/mozilla/themes/classic/messenger/primaryToolbar.css
@@ -242,21 +242,30 @@
   -moz-image-region: rect(21px 88px 42px 66px) !important;
 }
 
-#junkBarImage {
-  list-style-image: url("chrome://messenger/skin/icons/junkBar.gif");
+/* ::::: message notification bar style rules ::::: */
+
+.msgNotificationBar {
+  border-bottom: 1px solid;
+  -moz-border-bottom-colors: #000000;
+  -moz-appearance: toolbox;
+  background-color: #C7BC8F;
+  color: black;
 }
 
-#junkBarMessage {
+.msgNotificationBarText {
   font-weight: bold;
 }
 
-#junkBar {
-  border-bottom: 1px solid;
-  -moz-border-bottom-colors: #000000;
-  background-color: #C7BC8F;
+#junkBarImage {
+  list-style-image: url("chrome://messenger/skin/icons/junkBar.gif");
 }
 
 #junkIcon {
   margin-left: 0.5ex;
   list-style-image: url("chrome://messenger/skin/icons/folder-junk.gif");
 }
+
+#remoteContentImage {
+  list-style-image: url("chrome://messenger/skin/icons/remote-blocked.png"); 
+  padding: 3px;
+}
diff --git a/mozilla/themes/modern/jar.mn b/mozilla/themes/modern/jar.mn
index 1385ff316cd..e5976acd695 100644
--- a/mozilla/themes/modern/jar.mn
+++ b/mozilla/themes/modern/jar.mn
@@ -396,6 +396,7 @@ modern.jar:
   skin/modern/messenger/icons/message-news-offl.gif                (messenger/icons/message-news-offl.gif)
   skin/modern/messenger/icons/readcol-read.gif                     (messenger/icons/readcol-read.gif)
   skin/modern/messenger/icons/readcol-unread.gif                   (messenger/icons/readcol-unread.gif)
+  skin/modern/messenger/icons/remote-blocked.png                   (messenger/icons/remote-blocked.png)
   skin/modern/messenger/icons/server-local-new.gif                 (messenger/icons/server-local-new.gif)
   skin/modern/messenger/icons/server-local.gif                     (messenger/icons/server-local.gif)
   skin/modern/messenger/icons/server-mail-new.gif                  (messenger/icons/server-mail-new.gif)
diff --git a/mozilla/themes/modern/messenger/icons/remote-blocked.png b/mozilla/themes/modern/messenger/icons/remote-blocked.png
new file mode 100755
index 0000000000000000000000000000000000000000..130f6752de55a2988edb19b9bdb574f85a4ef0ee
GIT binary patch
literal 2170
zcmV-=2!;2FP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F800009a7bBm002%P
z002%P0Tz9k-T(jyEJ;K`RCt`Nm)mb#)fL8n=ggV0=Vp(`8QU4hB#na|lMqs%3D7oe
z(-akif>ep8R%(g_{U_Ro@;CIQFGW?KBU&MmDy0RbAd%)q$Q@rv9AD#^@m$Z$*?X-%
zobiwei9jk#+R~Y=eb)Ew^?hrfJr3V;96x@%#~3qWt<Afxn>WVft+jbo&8zCj?c2A1
zKQ}jb0k8nxH%)xv#0d`=0`k_{ytOtjB6$(Xt7_*rFqq9|-E=xlUtb^TbejJDelnR1
zr%s*X?Af!6!0&)%0Pn<!6K*z}9dsNg59EU&$g656xrpSgwRs@d+uIvWCX*zSNm8j4
z>2#WOI!!8-qQAeNzP>(EsT7e&<e{7R=%bHlwOYeK@7A0*GBUCnjYbFK@wgL@$4Mj-
zBoYa>fRf21>2#W8GD##7!Ev02Cf~?zkkdLM1*~mg#3wL50d*pzNwf}Qt=(GQN#cpf
zw%1>O{gH{clK1O9L|Py|R(y;Ju+%~z@rf3FR@ERVf}$v*;d3IkokTmAh;-%l?w{!I
znMd#u+r$un(?GRJuH2-i2HQ@mC>Ci02*$YhHJ4}#)a?eh2y!2|sy>=PqY)CoRd5t_
z1a-C&eHGlVc-%ObB|hU)D3@4HR3I7Q*e?M$To(fBLw670-lt0l{0+gI6_3jMdpI!r
z1mkuOyS$wYRWp<pH+b*uRtJ1bl1CEgnsnqFfeXUSg&}gq9mI13#54U2L^JfcY2r=~
zYinzWz0V760uPqIBY~>oI1cKxmp=f$urR{Xe1I{AAP5-S<1uh81#!iZPK7&BFIMr(
z5n`DD(JyuHs`eIvZVBj=&7!Q|>*vlwj!*AR(y~yuLaSNi+Uau~X>F1uO)4-L2`HEX
zB`s644XmfQ34>^8z%71{tiV=?6PDPbEU#p_Jad3bJxkh!mMcVDLsipgG|OUbk){TC
zCdLP~k13bS)O<tBC@zLS|6zt?GRfhWCfIlQYb59pXz#q$iZFe956#9P1Ca=-P*;n%
z(2NN6>^L{p&+zf;d92&Zz_wuqCJ!-`+zydmR9XbJ6<TZ8IQf^eeD-0UH{U$+P!o0&
z&`|R$7e=^S8D+qA8Hzhtf#rrv1R>%$;6`W|mw0BF+|(<0i9D);QAI^S1uvSx?c2ky
zT@9+!f9I{Y-eO~8<0}NZ+HlLY1#*Zg2Bql3W)rNV9g{W}-XogmXYAQG=t+!rfvZZW
zy_iscw};5YYox~xQV)Rpj^T$&U<77LIeHwWrWR`zb-)+Fw?cL8BDS_p{@FKhT@ND)
zBKUXzLv85_o7Dzh#HBx*!yElR(wjp?kl`2DyYC*Q&CUHcKf93W5O}ZxP2*5)_?TD}
z!NYe#f`M4-#;5rCzZg6C3)G2XM8e}07wea}vs!2$x5Da1k;v>c<NKdShF=KV@v)yX
z`o;WXD~q>(T`H{40A;t^141MckkJJi{w9@XgJP>ivDKmyG^wmyB$?_XlH7r@Ev$s)
zHe!i?=VczB+!spFK3jqy;O3<>=*Cq<LYa1q?;|(7{Z(KJaJmR6pstX!UtlV?@vF=D
z)fN2O3eC!0f|X0ehxc_fuPlE;vvd<B1dZ%`nTg4Ls46NJRmB>^^7Rj}YC$cHZQmo+
z*S7;W1jO72Js_$)^<$5WohK;GhNC!3vp7$sTq2gtg@#k1e)l}LJ~>Hq<2ptp1ljo#
zlao(`2b#5rDjS6YG&V5eVDU&M(-GiFAlcmoDhNvdV1*+;jkBEvY-tu#oW>MqX|@6!
zFM+C{B2=n%nyr9aXa7cU?@CyD5oG5}Ozho{h=#qdLZr6Xmd4^mJsii$0jUSN;LBDV
z9xHJCw{g~2k}O?~<E1SBeCG?SY2tX&_KS<E5Cp>Xxpx`=u8(B*W36DuUS!f*Zd|>D
zh+w@qsumF;Xa%UM19%U3p!+i6xG{E&CHTQBX^tG*#pviL&FXTe&-=0?U52}L?i8$^
z!?c0?9Y14Y>Pe!}7=Ge0L<B*oR?7-(0<Eq#jK_vZXo6TQiR<-q&xtWu7z6_}VQOlH
zPcB`@8<;`>Z}bS>%uQOYR>yER&%e*a!6x;=XHc~?b{u18b}xa1pYeF%Dy3qfMtCc(
zc1h6d|1f-Lg0Ys`-Md_wyTa`3EHg7REG#T&a$uP8T~&u@0*Uo8e()#UJa-yvOjtQ<
zxqklNOg`11mOG4!p&8o-)(1Dr+T119mKN^-p93{dL@>s%w6w&+!UFU2^UTf7F+V>q
zg+ifTE|)h;rBb0<t*!!#d!`QT%@3b^F1GJiq2aOzc>MV^>(@@Rw!RK3SP|xLTqK_!
zr{$$W?G;jm%UqkA_8ax;r@#duaE=~5Y5=EHDpiZc;%1>x*x20MTm=@}WxCsbUINw~
z$B8}nqZd!_-T%yP#*SjuK~%6}(V&J~Uqam;{GK6H6cHb5ExnB;Zk;))S1+CYFYq?-
zSD@}>GMN`krP48=b|2U>a1W>eKA{UbTIEJY5APhGcxP&IV!MvNip2%B7;!qSwq-aK
zCBA-^>*vqN^~>k4inZ?oe**46_+^R$eWCI++hAY4Idq2$&Y>rsdghNqL&Hyx?Vfak
z;X?#&ssrw5li0=;R_3m7dv3ZhKYime@P2#e(_0vi{x|aV;Q~7osq}A#^JA~2QhmEq
z=~OHdiDHbQS}E&hsZd^9UcA%v8<&9(fq%5C+}Ys&LtrbCz~jKvz<ywRJMSj2O1RsL
wz#Pzc@a1oVz*a<oM0<EZ0My&VJnE(Y0WpQORTaCc<^TWy07*qoM6N<$f~yc35dZ)H

literal 0
HcmV?d00001

diff --git a/mozilla/themes/modern/messenger/primaryToolbar.css b/mozilla/themes/modern/messenger/primaryToolbar.css
index 02c7c1d9669..c22c4424714 100644
--- a/mozilla/themes/modern/messenger/primaryToolbar.css
+++ b/mozilla/themes/modern/messenger/primaryToolbar.css
@@ -254,22 +254,30 @@
   -moz-image-region: rect(68px 199px 101px 150px) !important;
 }
 
-#junkBarImage {
-  list-style-image: url("chrome://messenger/skin/icons/junkBar.gif");
+/* ::::: message notification bar style rules ::::: */
+
+.msgNotificationBar {
+  border-bottom: 1px solid;
+  -moz-border-bottom-colors: #000000;
+  -moz-appearance: toolbox;
+  background-color: #C7BC8F;
+  color: black;
 }
 
-#junkBarMessage {
+.msgNotificationBarText {
   font-weight: bold;
 }
 
-#junkBar {
-  border-bottom: 1px solid;
-  -moz-border-bottom-colors: #000000;
-  background-color: #C7BC8F;
+#junkBarImage {
+  list-style-image: url("chrome://messenger/skin/icons/junkBar.gif");
 }
 
-
 #junkIcon {
   margin-left: 0.3ex;
   list-style-image: url("chrome://messenger/skin/icons/message-junk-other.gif");
 }
+
+#remoteContentImage {
+  list-style-image: url("chrome://messenger/skin/icons/remote-blocked.png"); 
+  padding: 3px;
+}
diff --git a/mozilla/xpfe/communicator/resources/content/contentAreaClick.js b/mozilla/xpfe/communicator/resources/content/contentAreaClick.js
index de05dc70d15..e087441cd54 100644
--- a/mozilla/xpfe/communicator/resources/content/contentAreaClick.js
+++ b/mozilla/xpfe/communicator/resources/content/contentAreaClick.js
@@ -110,10 +110,12 @@
     }
   }
   
-  function hrefForClickEvent(event)
+  function hrefAndLinkNodeForClickEvent(aParams)
   {
+    var event = aParams.event;
     var target = event.target;
-    var linkNode;
+    var href = aParams.href;
+    var linkNode = aParams.linkNode;
 
     var isKeyPress = (event.type == "keypress");
 
@@ -142,7 +144,7 @@
       if (linkNode && !linkNode.hasAttribute("href"))
         linkNode = null;
     }
-    var href;
+
     if (linkNode) {
       href = linkNode.href;
     } else {
@@ -155,11 +157,13 @@
         }
         linkNode = linkNode.parentNode;
       }
-      if (href && href != "") {
+      if (href) {
         href = makeURLAbsolute(linkNode.baseURI, href);
       }
     }
-    return href;
+
+    aParams.href = href;
+    aParams.linkNode = linkNode;
   }
 
   // Called whenever the user clicks in the content area,
@@ -172,7 +176,9 @@
     }
 
     var isKeyPress = (event.type == "keypress");
-    var href = hrefForClickEvent(event);
+    var ceParams = {event: event, href: "", linkNode: null};
+    hrefAndLinkNodeForClickEvent(ceParams);
+    var href = ceParams.href;
     if (href) {
       if (isKeyPress) {
         openNewTabWith(href, true, event.shiftKey);
@@ -180,6 +186,10 @@
       }
       else {
         handleLinkClick(event, href, null);
+        // if in mailnews block the link left click if we determine
+        // that this URL is phishy (i.e. a potential email scam) 
+        if ("gMessengerBundle" in this && !event.button)
+          return !isPhishingURL(ceParams.linkNode, false);
       }
       return true;
     }
@@ -362,11 +372,11 @@
     }  // for
   }
 
-  function makeURLAbsolute( base, url ) 
+  function makeURLAbsolute(base, url)
   {
     // Construct nsIURL.
     var ioService = Components.classes["@mozilla.org/network/io-service;1"]
-                  .getService(Components.interfaces.nsIIOService);
+                              .getService(Components.interfaces.nsIIOService);
     var baseURI  = ioService.newURI(base, null, null);
 
     return ioService.newURI(baseURI.resolve(url), null, null).spec;