New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 591692 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 483899
Owner: ----
Closed: Mar 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Site permissions still unreachable after 1+ year of their removal

Reported by vphan...@gmail.com, Mar 3 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36

Steps to reproduce the problem:
1. Click the icon to the left of the address bar
2. Notice in "Permissions" the single "Site settings" hyperlink and absence of actual permissions (i.e. disabling JavaScript)
3. Clicking "Site settings" goes to the GLOBAL chrome://settings/content
4. Something as trivial as disabling JavaScript for the current site now requires to fish for JavaScript in chrome://settings/content, click "Manage exceptions", then see if there's already an entry for the current domain and, if not, create one by manually typing the host/domain and saving.

What is the expected behavior?
If you're still convinced that hiding permissions behind a "Site settings" link in the now wrongly-named "Permissions" tab of this pop-up, at least do as promised (I can't find the issue number...) and link to a panel which is SPECIFIC to the current site, as before, to avoid users fishing for settings and manually transcribing the site's host name multiple times (a risky source of errors).

What went wrong?
This is a security concern because average users will not likely go through the trouble necessary to add any individual site permission restrictions, whereas all permissions USED to be offered very clearly in that site pop-up.

Did this work before? Yes January, 2015 roughly Chrome version 40

Chrome version: 48.0.2564.116  Channel: stable
OS Version: 4.2.0
Flash Version: Shockwave Flash 20.0 r0
 

Comment 1 by vphan...@gmail.com, Mar 3 2016

Found it! https://bugs.chromium.org/p/chromium/issues/detail?id=444244 - Here someone proudly removed permissions from the "Origin Info Bubble" (still no idea why) without moving them anywhere else.  As described above, the replacement "Site Settings" link does in no way replace this important way to present permissions.

Please see https://bugs.chromium.org/p/chromium/issues/detail?id=444244#c20 in particular: "The generic content settings page will be replaced soon with a link to the full settings for the specific origin." - This is the unfulfilled promise I was referring to above, dating back March 4, 2015.

We're still waiting and I couldn't find an issue describing it (fell through the cracks?) hence this issue here.

Thank you for your time.
Cc: palmer@chromium.org
Components: Security>UX
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Via-Wizard Type-Bug
Thanks for reporting this issue, vphantom!
+palmer@, would you mind chiming in? 
Cc: f...@chromium.org
Mergedinto: 483899
Status: Duplicate (was: Unconfirmed)
Yep, we're going to revert the change, since the replacement UI never materialized.

Hopefully for M50.
Components: -Security>UX
Labels: Team-Security-UX
Security>UX component is deprecated in favor of the Team-Security-UX label

Sign in to add a comment