palant / pfp

A simple and secure browser extension to be used with KeePass databases.
https://pfp.works/
Mozilla Public License 2.0
113 stars 14 forks source link

PfP panel can't be opened within many popup windows #113

Closed ghost closed 4 years ago

ghost commented 4 years ago

A number of pages use code equivalent to the following when opening popup windows:

window.open('about:blank', 'Popup', 'width=800,height=600')

I have seen this e.g. for Paypal popups (I think at dhl.de).

In such popup windows, it is currently impossible to open the PfP panel -- the toolbar button is hidden and Ctrl-Shift-F does not work.

Is there a way to make this use case work anyway? I understand that (for good reason) you hate injecting code into the page itself but the current option where I have to use another browser window to copy the password into the clipboard is probably not much more secure.

Not sure if there is a Firefox setting that allows forcing the toolbar=1 option for such windows or if this could be forced in other ways -- if PfP could force a toolbar, that would be the best possible solution for me.

palant commented 4 years ago

Unfortunately, as an extension there is nothing we can do about this.

As a user, you can change Firefox settings however. For that, go to about:config, accept the warning, find dom.disable_window_open_feature.toolbar setting and double-click is to turn the value into true.

Closing as "invalid" given that this isn't our limitation - it's the browser's.

ghost commented 4 years ago

Thanks, the Firefox setting is helpful. (Even though an automatic cross-browser solution would have been nicer.)

ghost commented 4 years ago

As of Firefox 79, the setting appears to be broken. :(

palant commented 4 years ago

Yes, it seems that all the window feature parameters are ignored now. window.open() documentation says:

In modern browsers (Firefox 76 or newer, Google Chrome, Safari, Chromium Edge), the following features are just a condition for whether to open popup or not.

So as of now, the only way to “fix” this I can think of is modifying browser's styles. For that, you have to go to about:config and make sure toolkit.legacyUserProfileCustomizations.stylesheets preference is set to true. Then you have to go to your Firefox profile (go to about:support and click “Open Directory” in the “Profile Directory” row), create a chrome folder there and a file userChrome.css inside the folder with the following contents:

#easypasswords_palant_de-browser-action
{
  display: -moz-box !important;
}

Restart your browser and with some luck the PfP button should appear in any pop-up window.

palant commented 4 years ago

I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1663572 on this. Not that I really expect Mozilla to tackle this given that Chrome has the same issue…

ghost commented 4 years ago

Thanks a lot for the (working!) workaround. I already had most of this in place, because I am using a CSS-based theme already. :)

Also thanks for the bug!