diff options
| author | Moonchild <moonchild@palemoon.org> | 2020-08-28 06:46:12 +0000 |
|---|---|---|
| committer | Moonchild <moonchild@palemoon.org> | 2020-08-28 06:46:12 +0000 |
| commit | 9798bd075eb807dce8d3248f39fa6c857b1e06d5 (patch) | |
| tree | f50b26e17c2ee544decae21f5e6fde58c9eefcfe /modules | |
| parent | fe04e4177491d2db1b950fa9f539bec9833cacd1 (diff) | |
| download | uxp-9798bd075eb807dce8d3248f39fa6c857b1e06d5.tar.gz | |
[media] Only include source error details in debugging scenarios.
Unless a user is debugging media errors, this detail is unnecessary to report
and could include sensitive data which could be abused by third-party
requesters. This aligns it with the standard success/error paradigms in normal
browsing situations.
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/libpref/init/all.js | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 2a50d3704c..5eed08f865 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -5440,3 +5440,11 @@ pref("prompts.authentication_dialog_abuse_limit", 0); // Whether module scripts (<script type="module">) are enabled for content. pref("dom.moduleScripts.enabled", true); +// Report details when a media source error occurs? +// Enabled by default in debug builds, otherwise should be explicitly enabled +// by the user to prevent XO leaking of the response status (CVE-2020-15666) +#ifdef DEBUG +pref("media.sourceErrorDetails.enabled", true); +#else +pref("media.sourceErrorDetails.enabled", false); +#endif |